Create the first Platform Owner

The first Platform Owner replaces the temporary setup-code authority with a named operator account before the managed-platform Setup wizard begins.

Only complete this process over the private Control Plane connection.

Open first-owner setup

After opening the newly bootstrapped Control Plane, MEM directs you to /bootstrap while no completed, enabled Platform Owner exists.

Enter the mem_... setup code generated by the host bootstrap. The server exchanges it for a short-lived, scoped bootstrap grant. That grant is not a normal operator session.

Create the named owner

Provide:

• a unique username;
• an optional valid email address;
• a strong password and confirmation.

The account remains in bootstrap state until TOTP is verified and the flow completes.

Enrol TOTP

Scan the QR code or enter the authenticator secret into a trusted TOTP application, then submit the current six-digit code.

TOTP is part of the Platform Owner security boundary.

Store recovery codes

After successful completion, MEM displays recovery codes. Store them offline or in a trusted password manager before acknowledging completion.

They are capability-bearing recovery material and should not be placed in ordinary documentation, tickets, screenshots, or chat.

After first-owner bootstrap

When a completed Platform Owner exists:

• the owner is signed in and authenticated Setup can begin;
• /bootstrap no longer opens another first-owner flow;
• the setup code no longer grants first-owner authority;
• normal operator authorization and MFA policies apply;
• additional named operators can be enrolled later.

Before creating the first chat stack, confirm that the owner can sign out, sign back in, use TOTP, and retrieve the stored recovery procedure.