┌─────────────────────────────────────────────────────────────┐
│                   PLATFORM SUPER ADMIN                      │
│                  (Central Control Plane)                    │
│  • Manages ISP Tenant accounts, SaaS tiers & domains        │
│  • Provisions authoritative ISP Admin accounts              │
│  • Monitors global infrastructure, MRR & Redis caching      │
└──────────────────────────────┬──────────────────────────────┘
                               │ Provisions ISP Admin
                               ▼
┌─────────────────────────────────────────────────────────────┐
│                      ISP ADMINISTRATOR                      │
│                  (ISP Managing Director)                    │
│  • Full administrative authority within their ISP tenant   │
│  • Configures MikroTik routers, OLTs, and IP pools          │
│  • Configures billing packages, zones & payment gateways    │
│  • Directly provisions & delegates ISP Office Staff         │
└──────────────────────────────┬──────────────────────────────┘
                               │ Provisions & Delegates
                               ▼
┌─────────────────────────────────────────────────────────────┐
│                      ISP OFFICE STAFF                       │
│             (Technicians, Accountants, Support)             │
│  • Managers: Operational management & customer onboarding   │
│  • Accountants: Billing verification & ledger balancing     │
│  • Technicians: Router telemetry, fiber cuts & tasks        │
│  • Support Agents: Ticketing, complaints & call-logging     │
└─────────────────────────────────────────────────────────────┘

def provision_tenant_admin(
    tenant, username, password, email='', phone='', first_name='', last_name=''
):
    # 1. Guarantee tenant default RBAC roles exist
    seed_default_roles_for_tenant(tenant)
    
    # 2. Retrieve the authoritative 'Admin' role
    admin_role = (
        Role.objects.filter(tenant=tenant, name__iexact='Admin').first()
        or Role.objects.filter(tenant=tenant, name__iexact='ADMIN').first()
    )
    if not admin_role:
        admin_role = Role.objects.create(
            tenant=tenant,
            name='Admin',
            description='Full administrator access',
            is_system_default=True,
            permissions=['__all__'],
        )
    
    # 3. Create or update Django User
    user, _ = User.objects.get_or_create(username=username, defaults={
        'email': email,
        'first_name': first_name,
        'last_name': last_name,
        'is_staff': True,
        'is_superuser': False,
    })
    user.set_password(password)
    user.save()
    
    # 4. Create or update legacy StaffProfile
    StaffProfile.objects.update_or_create(
        user=user,
        defaults={'role': UserRole.ADMIN, 'phone': phone, 'is_active': True}
    )
    
    # 5. Create or update authoritative StaffMembership
    StaffMembership.objects.update_or_create(
        tenant=tenant,
        user=user,
        defaults={
            'role': admin_role,
            'scope': StaffMembership.Scope.TENANT,
            'is_active': True,
        }
    )
    
    # 6. Issue Authentication Token & Invalidate Caches
    Token.objects.get_or_create(user=user)
    invalidate_saas_tenant_cache(tenant.id)
    return user