Written by Huifer, solo developer and maintainer of TanStack Ship. I have evaluated nine SaaS admin dashboard templates since 2024 across two of my own SaaS products and three agency client engagements. For this post I rebuilt the same admin module (RBAC + tenant scoping + audit log + bulk actions) inside each template on identical specs, scored each on seven dimensions, and logged every red flag I hit. The 9-template, 7-feature, 7-red-flags figure is what came out of that work — including the one dashboard I genuinely expected to win that lost on day 1.

Verified sources: TanStack Start · Cloudflare Workers · Cloudflare D1 · Stripe Billing · Better Auth · ShipFast · Makerkit · Wasp Open-SaaS · Next-Forge

Last updated: 2026-05-10 · Changelog

TL;DR: I rebuilt the same admin module inside 9 SaaS dashboard templates on identical specs and scored each on 7 features plus 7 red flags. Top picks: TanStack Ship for edge-first React with nested RBAC and a D1 audit log, Makerkit for B2B org/role depth, ShipFast for Vercel DX. Free tiers ship only flat roles and console-only audit logs. The 7 red flags appear at the bottom of every free tier and most paid kits — including the dashboard that scored highest on community but lowest on production fitness.

SaaS Admin Dashboard Templates: 7 Red Flags Before You Buy

Why admin dashboards are the SaaS feature most buyers regret not checking

The admin dashboard is the part of the SaaS that nobody screenshots in marketing copy. Every template's homepage hero shows the customer-facing UI; the admin module lives behind a login, so nobody talks about it. By month 6 it is the part of your codebase you touch every day. By month 12 it decides whether you can pass a SOC 2 or enterprise security review.

Most kits ship a "basic admin" page and call it done. They do not ship tenant scoping, audit logs, role hierarchies, impersonation, bulk actions, or theming — the seven things every B2B SaaS with paying customers needs by month 3. If you must build these yourself, expect 8–12 weeks. The 7 red flags below are the patterns that tell you whether the kit shipped the work.

The 7-feature rubric I score every admin dashboard against

I built this rubric after watching three agency engagements fail in the same way: a kit that looked complete in the demo turned out to ship a flat role model and a single-table query. The 7 features below are the minimum I look for before I trust a kit with a real customer dataset.

RBAC depth

Look for nested roles (admin > manager > member > viewer), per-resource permissions (read / write / delete), and role inheritance. The flat is_admin: boolean pattern is a red flag on its own; it forces a refactor by month 4. TanStack Ship and ShipFast ship nested roles; Makerkit goes deeper with per-resource scopes.

Tenant scoping

Every list query and detail view must filter by the active tenant. The pattern that breaks is when the kit ships "filter by orgId" on some queries but not others — usually the lookup tables. Verify by running two tenants in dev and clicking through every list. TanStack Ship scopes at the ORM layer; Makerkit scopes per-route; Wasp scopes per-server-function.

Audit log + impersonation

Every admin action writes to an audit table: actor, action, resource, IP, timestamp. Impersonation ("log in as this user") needs its own entry — SOC 2 auditors specifically ask for it. Most kits log to console only. TanStack Ship, ShipFast, and Makerkit persist audit logs to D1 or Postgres.

Bulk actions

Selecting 50 rows and changing their status in one click is the top operator feature for any admin module above 1,000 records. Look for checkbox states, shift-select, and per-action confirm modals. Most kits ship only single-row actions.

Export + CSV

Filtering then exporting to CSV is the second-most-used admin feature after search. Most kits have a "download CSV" stub that returns hard-coded columns. Verify the export honors your filters.

Theme + i18n

A white-label-ready admin module themes via CSS variables and ships string externalization. Hard-coded hex colors or English strings in JSX are red flags. TanStack Ship and Makerkit both ship tokenized themes.

AI editor fit

The kit ships a versioned CLAUDE.md, Skills, and .cursorrules so AI coding agents stay inside the kit's conventions. Without this you lose 30+ minutes per session teaching the editor how the kit is shaped. TanStack Ship and Makerkit both ship Skills; most free kits do not.

The 7 red flags that kill an admin dashboard template on day 1

These are the patterns I have seen break production in 2024 and 2025. If a kit hits three or more, walk away.

Hard-coded admin role

Look in the schema: is_admin: boolean on the users table is the smoking gun. A boolean role cannot model a hierarchy, cannot scope to a resource, and cannot be granted temporarily. Replacing it with a proper RBAC table is a 2-week migration at minimum.

Single-table scoping

The kit filters WHERE org_id = $tenant on obvious tables (users, projects) but not on lookups, joins, or aggregates. Run a tenant isolation test: create a second tenant, click through, and look for cross-tenant leakage in dropdowns and reports. TanStack Ship scopes at the ORM layer; if the kit scopes in route handlers only, expect leakage.

No audit log

The kit writes logs to console but not to a queryable table. If you cannot answer "what did admin X do on March 4" with SQL, you do not have an audit log. SOC 2, ISO 27001, and HIPAA all require this.

Fake bulk actions

The demo shows checkboxes but the action only updates one row at a time (visible in network tab). Verify by selecting 10 rows and clicking the action.

Vendor-locked theme tokens

Hex values hard-coded in components, Tailwind colors referenced directly, or theme overrides that require editing node_modules. A white-label SaaS sold to agencies must re-theme via CSS variables only. Makerkit ships a theme override API; TanStack Ship tokens ship at the CSS-variable layer.

Untyped mutations

Forms that POST to /api/admin/users/update with body: any and rely on the database to reject bad input. TanStack Start + TanStack Query give you typed mutations for free; if the kit bypasses them with fetch, you will pay in subtle data corruption.

Zero documentation

If the kit's admin module has no README beyond "see the demo," expect 4–8 hours per onboarding ticket for the first quarter. Documentation includes a role-permission matrix, an impersonation guide, and a tenant-isolation test recipe.

Decision matrix: which admin dashboard fits which team

The two surprises: create-t3-app is missing the entire admin module (you build it from scratch), and Wasp Open-SaaS ships only single-row bulk actions despite being the largest free option. If you need both deep RBAC and AI-editor Skills, the scorecard narrows to TanStack Ship and Makerkit.

Code: the RBAC + audit-log layer you should demand

If you are evaluating a kit, paste this TypeScript into the admin route and see if the kit supports it without refactor.

// app/routes/admin/_middleware.ts
import { createMiddleware } from "@tanstack/start";
import { db } from "~/lib/db";
import { writeAudit } from "~/lib/audit";

export const adminMiddleware = createMiddleware().server(async ({ next, request }) => {
  const session = await getSession(request);
  if (!session?.user) throw redirect("/login");

  // RBAC: scoped to resource + action
  const permission = await db
    .selectFrom("permissions")
    .innerJoin("roles", "roles.id", "permissions.role_id")
    .where("roles.user_id", "=", session.user.id)
    .where("permissions.resource", "=", "admin")
    .where("permissions.action", "in", ["read", "write"])
    .executeTakeFirst();

  if (!permission) throw redirect("/403");

  // Tenant scoping: every downstream query reads from request context
  const tenant = await db
    .selectFrom("tenants")
    .innerJoin("members", "members.tenant_id", "tenants.id")
    .where("members.user_id", "=", session.user.id)
    .executeTakeFirst();

  if (!tenant) throw redirect("/select-tenant");

  // Audit: every admin route now logs context
  await writeAudit({
    actor: session.user.id,
    tenant: tenant.id,
    path: new URL(request.url).pathname,
    ip: request.headers.get("cf-connecting-ip") ?? "unknown",
    ua: request.headers.get("user-agent") ?? "unknown",
  });

  return next({ context: { tenant, user: session.user, permission } });
});

And the audit table that goes with it on Cloudflare D1:

-- migrations/0008_admin_audit.sql
CREATE TABLE admin_audit (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  actor_id TEXT NOT NULL,
  tenant_id TEXT NOT NULL,
  action TEXT NOT NULL,
  resource TEXT NOT NULL,
  resource_id TEXT,
  ip TEXT NOT NULL,
  ua TEXT NOT NULL,
  metadata TEXT,            -- JSON: before/after diff
  created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
  FOREIGN KEY (actor_id) REFERENCES users(id),
  FOREIGN KEY (tenant_id) REFERENCES tenants(id)
);
CREATE INDEX idx_admin_audit_actor ON admin_audit(actor_id, created_at DESC);
CREATE INDEX idx_admin_audit_tenant ON admin_audit(tenant_id, created_at DESC);

If a kit cannot fit this pattern in under 100 lines of glue, the kit is hiding an RBAC ceiling you will hit by month 6.

The honest cases where the wrong kit is still the right buy

Three cases where a low-scoring kit is the right call, and where TanStack Ship is the wrong pick.

Case 1: Pre-MVP with no enterprise customers

If you are pre-product-market-fit and not selling to enterprise, RBAC depth does not matter. A flat role is fine for the first 1,000 users. Pick Wasp Open-SaaS or create-t3-app, ship in 14 days, and refactor later. TanStack Ship's per-resource permissions are wasted complexity at this stage.

Case 2: B2B org/role depth is the moat

If your product is B2B SaaS with org hierarchies and per-org billing, Makerkit's per-resource scopes beat TanStack Ship's nested roles. I have watched Makerkit ship a B2B procurement product in 21 days that would have taken 8 weeks on TanStack Ship.

Case 3: Shopify-style monorepo

If you are running a Turborepo with shared packages across three apps, Next-Forge's monorepo layout beats TanStack Ship's single-app focus. The $399 license pays back inside the first sprint if your team is >5 engineers.

FAQ

What is the best SaaS admin dashboard template in 2026?

For solo or small-team SaaS on TanStack Start + Cloudflare Workers: TanStack Ship at $299, with nested RBAC and a D1 audit log. For B2B multi-tenant: Makerkit at $279, with per-resource scopes. For Vercel DX: ShipFast at $199, with the largest community. For free pre-MVP: Wasp Open-SaaS at $0.

How long does it take to build a SaaS admin dashboard from scratch?

8–12 weeks for a 2-person team covering RBAC + tenant scoping + audit log + bulk actions + export + theme + i18n. At a $50/hr blended rate that is $13,000–$20,000 in opportunity cost — the figure that justifies a $299 license.

Do free SaaS boilerplates ship an admin dashboard?

Yes, but only the basics. Wasp Open-SaaS ships users, projects, and a single-row actions table. create-t3-app ships no admin module. If your needs go beyond a single role and a users page, expect 300–500 lines of glue.

What is the difference between RBAC and ABAC?

RBAC (role-based) maps users to roles and roles to permissions. ABAC (attribute-based) maps users to policies that evaluate runtime attributes (time, IP, resource state). TanStack Ship and Makerkit ship RBAC; ABAC is a 2026 ask in a few enterprise RFPs and not in any kit I have tested.

Can I migrate from one admin template to another later?

Yes, but the migration cost is 2–4 weeks per admin module. The schema migration is the cheap part; the RBAC and audit-log refactor is the expensive part. For a Day-0 cost comparison across 10 kits, see the SaaS boilerplate comparison 2026 scorecard.

Do I need an audit log if I am not SOC 2 certified?

Yes, for three reasons. (1) Customer security questionnaires ask for it. (2) On-call debugging is faster with a queryable log. (3) Internal abuse cases are answerable. The cost of a 1-row insert per admin action is roughly $0.10/mo at 100k MAU on Cloudflare D1 — free in practice.

For the admin module spec sheet, see features. For license tiers and what is included, see pricing. For the per-module build cost of building from scratch, see the multi-tenant architecture guide. For Ship's admin module shipped to first customer in 14 days, see Try TanStack Ship →