# Operations

> **Audience:** Studio operators and administrators

Studio separates ordinary content administration from infrastructure and
database lifecycle work. An administrator account alone does not grant access
to every recovery operation, and changing a site mode never changes D1 by
itself.

## Operational controls

- [`STUDIO_SITE_MODE`](site-modes/index.md) selects the application's broad
  availability boundary.
- [Maintenance & Recovery](maintenance-and-recovery/index.md) is a separately
  enabled, exact-IP and token-protected surface for backups, restores,
  lifecycle operations, access recovery, and destructive work.
- The Studio database and Edge database have independent lifecycle state and
  independent backup artifacts.
- Studio never changes Worker environment gates, site mode, or Edge integration
  mode automatically after an operation.

## Safe default

Keep a healthy installation in `operational` mode and keep the operations
surface disabled when it is not needed. Before planned schema or destructive
work, retain an independently reviewed backup, switch to the required mode,
perform one bounded workflow, verify the result, and explicitly return to the
normal configuration.

For Edge maintenance, stop public Edge writes before touching the Edge database.
`STUDIO_SITE_MODE=maintenance` blocks Studio APIs but cannot stop a separately
deployed Edge Worker.