Built-in account protections

Automation orchestrator marks the built-in administrator account as a built-in system user and enforces the following restrictions to prevent accidental lockout:

  • The built-in administrator account cannot be deleted. Attempts to delete it return a 403 ADMIN_DELETE_FORBIDDEN error.
  • Only the built-in administrator can modify its own account. The only permitted changes are setting is_enabled to false and changing the password. Automation orchestrator rejects changes to username, full_name, or email with a 403 ADMIN_MODIFY_FORBIDDEN error.
  • Other administrators can re-enable the built-in administrator account by setting is_enabled to true. No other changes are permitted.
  • The last enabled administrator in the system cannot be disabled. If the built-in administrator is the only enabled administrator, attempting to disable it returns a 403 ADMIN_DISABLE_NO_OTHER_ADMINS error.
  • Built-in groups (such as admins) cannot be deleted. Built-in users cannot be removed from built-in groups.