Control Room is the operational UI installed in your GCP project. It brings together the products enabled for that customer installation. The hosted Platform portal manages your Fluffy account, organization, and entitlement separately.
#Understand: a view of several systems
A preview has a source revision and a lifecycle. A temporary access request has a provider grant state. A flag has a published configuration revision. Control Room presents those facts together, but the selected system still determines their meaning.
For example, an approved access request may still be waiting for provider activation. A restored audit record is historical evidence, not a new permission. Check the resource, application, environment, and revision before acting on a status.
#Configure: open the correct installation
Use the URL printed by Premium installation, then sign in with an identity allowed by its configuration. Confirm the installation and selected application/environment. Navigation depends on enabled capabilities and available application bindings.
Opening Control Room does not require adding code to your application. Product setup may require configuration or runtime grants; follow the guide for the operation you need.
| Task | Where to work | Evidence to check |
|---|---|---|
| Review or stop a PR environment | Previews | Repository, commit, lease and lifecycle state |
| Request, approve, deny, or end resource access | Exact Google PAM link from the package | Human identity, physical resource, duration and provider grant state |
| Review an emergency incident | Resource Access retrospective review | Incident, justification and supporting timeline |
| Edit, publish, or roll back flags | Flags configuration | Application, environment and configuration revision |
| Inspect flag exposure analytics | Configured flag analytics | Revision, variation and data freshness |
| Inspect application signals | Enabled observability | Monitor/counter, application revision and available traffic |
The preview, access, flag, and observability chapters explain the underlying configuration. Control Room is not a general shell or SQL administration console.
#Recover Resource Access records
An organization owner can separately enable hosted backup in the Platform portal. This option copies normalized Resource Access operational records—requests, incidents, reviews, and audit records—under the configured hosted boundary.
Use the portal's restore authorization and the customer Control Room recovery flow. Check the target installation and restored history. Restoring those records does not create a Google PAM grant, restore an application's PostgreSQL data, or recover deployment credentials.
For application database recovery, use the separate database recovery guide. There is no general CLI backup command implied by the hosted record-backup option.
#Reference: missing or stale information
| What you see | What to establish |
|---|---|
| A product section is absent | Its capability is enabled and its target bindings exist |
| A permission error | Correct Google identity and installation group membership |
| Access approval shown, grant pending | Current PAM state and provider propagation |
| An old preview revision | The requested commit and the corresponding build result |
| No recent observability data | The monitor's scope, traffic, deployment and data freshness |
| A restored access request | Whether it is historical evidence or linked to a currently active provider grant |
Follow the exact provider link when resolving a provider decision. Control Room does not impersonate a human approver. Installation service removal uses the reviewed Premium CLI uninstall workflow; application deployment and account subscription remain separate operations.