From 8f67bba40a3c1f242d43fe8ea6ce6a10b727d524 Mon Sep 17 00:00:00 2001
From: chasprowebdev <chasgarciaprowebdev@gmail.com>
Date: Thu, 2 Apr 2026 21:25:36 -0400
Subject: [PATCH 1/2] fix(app): hide platform admin devices on People/Devices
 tab

---
 .../app/(app)/[orgId]/people/devices/data/index.ts   | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts b/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
index 3bb1db1aa..7bfafa59e 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
@@ -24,7 +24,17 @@ export const getEmployeeDevicesFromDB: () => Promise<DeviceWithChecks[]> = async
   }
 
   const devices = await db.device.findMany({
-    where: { organizationId },
+    where: {
+      organizationId,
+      // Exclude devices for users whose User.role is platform admin (not org Member.role).
+      NOT: {
+        member: {
+          user: {
+            role: 'admin',
+          },
+        },
+      },
+    },
     include: {
       member: {
         include: {

From 760fa005565a6a209b293900826bbc2374ec9594 Mon Sep 17 00:00:00 2001
From: chasprowebdev <chasgarciaprowebdev@gmail.com>
Date: Thu, 2 Apr 2026 21:38:34 -0400
Subject: [PATCH 2/2] fix(app): add platform admin filtering from fleet device
 source

---
 .../src/app/(app)/[orgId]/people/devices/data/index.ts   | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts b/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
index 7bfafa59e..b14004a38 100644
--- a/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/devices/data/index.ts
@@ -75,7 +75,7 @@ export const getEmployeeDevicesFromDB: () => Promise<DeviceWithChecks[]> = async
 
 /**
  * Fetches Fleet (legacy) devices for the current organization.
- * Returns Host[] exactly as main branch — untouched Fleet logic.
+ * Excludes members whose User.role is platform admin (same as getEmployeeDevicesFromDB).
  */
 export const getFleetHosts: () => Promise<Host[] | null> = async () => {
   const session = await auth.api.getSession({
@@ -90,11 +90,16 @@ export const getFleetHosts: () => Promise<Host[] | null> = async () => {
     return null;
   }
 
-  // Find all members belonging to the organization.
+  // Members with Fleet labels (exclude platform admins — same filter as device-agent path).
   const employees = await db.member.findMany({
     where: {
       organizationId,
       deactivated: false,
+      NOT: {
+        user: {
+          role: 'admin',
+        },
+      },
     },
     include: {
       user: true,