last_role_administrator

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

The change would leave the organization with nobody able to grant roles (409).

#Meaning

Revoking a role, suspending or blocking an account would leave the organization with no other active account holding roles.assign. The server refuses before changing anything, so no organization is left without someone who can grant roles.

#Impact

Nothing changed. An owner trying to step down, or to suspend the only other owner, sees this. It is expected and protects the organization from locking itself out.

#Diagnosis

Look the request id up on the Troubleshooting page. The refusal is recorded on the action that was refused (role.revoked, user.suspended or user.blocked) with reason conflict and cause last_role_administrator.

#Mitigation

• As an organization owner: grant org-owner to another active account first, then revoke or suspend.
• As an operator of the main organization: a platform owner can grant the role in the organization if no owner there is reachable.

#Escalation

Escalate when another active owner exists and the change is still refused. Open an issue with the request id, the organization slug, the role ids involved and the server version.

Problem code runbooks · Generated from internal/runbook/problems.yaml in nauthera-server.