Demo script: administrator tour #

This page is for creators whose audience runs sites: administrators, hosts, developers and IT leads. The administrator's screens show more than the editor's, and several of them can show data you must not publish, so this script names those screens and says how to film them. It follows parts 3, 7 and 8 of the 45-minute presales demo and runs about ten minutes.

Sign in as the administrator of a demo installation with invented content and invented accounts only (Setting up a demo installation). The menu names below are those of the admin4 design of the 6.0.15 line; say which version you show.

Contents #

1. Part 1: the content model (2 minutes)
2. Part 2: users, roles and languages (2 minutes)
3. Part 3: operations (3 minutes)
4. Part 4: security (3 minutes)
5. Screens that need care

Part 1: the content model (2 minutes) #

1. Open Setup > Classes, open the class Folder, point at its attributes.
2. Go back to a folder's edit form and show that each attribute is a card.
3. Say: "Content types are defined here, not in code. An article, a product, an event: each gets exactly the fields it needs." The README calls the content model Exponential's most notable feature: "its fully customizable and extendable content model."
4. Do not change a class on camera. Source: The content model and editing content.

Part 2: users, roles and languages (2 minutes) #

1. Users > Roles and policies: open the Editor role. Say: "What each group may do is a set of policies." Source: Roles and policies.
2. Point at the policy that opens the help: "The help is readable for editors on a new installation through the policy exphelp/read." (The help system)
3. Setup > Languages: show the content languages. Say the documented numbers with their source: 368 locale files can be used as content languages; administration translations exist (the current totals are at the top of Languages in Exponential) (Languages in Exponential).

Part 3: operations (3 minutes) #

1. Setup > Log files: the navigator and a search. Say: "Privacy first: e-mail addresses, IP addresses, passwords, tokens, keys and session ids are masked in this view." Never press Show unmasked on camera, and still read every line you show (Log viewer).
2. Setup > Upgrade check: "Before an upgrade, this compares every file with the release." (Upgrade check)
3. Setup > Caches: point at the buttons; say what clearing a cache is for. Do not clear on a site others use. (Caches)
4. Setup > System information: show the top only. Blur paths, host names and database details (System information).
5. Optional: Setup > Maintenance (Maintenance mode).

Part 4: security (3 minutes) #

1. Open the Audit tab (/audit/dashboard), then Console. Say: "My sign-in is already recorded. Every record carries the hash of the one before, so a change to the record shows." (The audit trail)
2. In a terminal, off the shared screen if it shows a prompt you mind: ./console exp:audit verify --allow-root-user.
3. Open /user2fa/setup on the demo account: show the choice of an authenticator app or an e-mail code. Do not finish the setup on camera: the QR code and the secret are the second factor (Two-step sign-in).
4. Open Content Security Policy in the help and say: "By default it is report-only on the administration and off on the sites; the page explains how to enforce it."
5. End on the Checklist of Security hardening.

Say nothing like "it is secure" or "it has never had a vulnerability". Say: "Here is the process and the checklist; vulnerabilities are reported privately to the address in SECURITY.md."

Screens that need care #

More: Keeping secrets off screen, Privacy on camera.

Related pages #

• Security hardening
• Talking points for administrators
• Demo script: Velocity
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.