Appearance
Administration
Where to find it: Administration (/admin/users and /settings/*).
Administration is where a tenant is configured: who can do what, how approvals route, what the deadlines are, and how the platform connects to the outside world.
The configuration surfaces
| Page | Route | Purpose |
|---|---|---|
| Users & Roles | /admin/users | User accounts, roles, permissions and organisational units |
| Workflow Settings | /settings/workflow | Approval chains, stages and bindings |
| SLA & Deadlines | /settings/sla | Deadline policy, reminders and escalation |
| Taxonomies | /settings/taxonomies | Classification trees and entity tagging |
| Risk Methodology | /settings/risk-methodology | Scoring, appetite and review cadence |
| Notification Providers | /settings/notifications | Delivery channels |
| Alert Policies | /settings/alert-policies | Conditions, recipients and sweeps |
| Integrations | /settings/integrations | API keys and webhooks |
| AI Settings | /settings | Tenant AI configuration |
Articles
| Article | What it covers |
|---|---|
| Users & Roles | Accounts, roles, permission scopes and organisational units |
| Entitlements | What each tenant entitlement unlocks |
| Workflow Configuration | Configuring approval chains and their consequences |
| Tenant Settings | Reporting currency, taxonomies and general configuration |
| SLA & Deadlines | Deadline policy, reminders and escalation |
| Notification Providers | Delivery channels and alert policies |
| AI Provider Settings | Tenant AI configuration and what is customer-configurable |
| Integrations | API keys and webhooks |
| Security Boundaries | Tenant isolation and the platform boundary |
The separation to understand first
Administering the system is not the same as exercising judgement within it
Certain permissions are never auto-granted, including to Tenant Administrators:
tprm.assess— governed third-party risk assessmenttprm.classify— regulatory classificationtprm.decide— engagement approvalassessment.review_self_override— the segregation-of-duties break-glass
A Tenant Administrator can configure the platform completely and still be unable to approve a material outsourcing arrangement.
This is deliberate. Whoever maintains the platform is not thereby qualified to make professional governance decisions inside it.
The platform boundary
Tenant administration and platform administration are different things with different audiences.
| Tenant administration | Platform administration | |
|---|---|---|
| Scope | Your tenant | The service |
| Who | Your administrators | The service operator |
| Covers | Users, roles, workflow, settings, integrations | Tenants, provisioning, deployments, platform security |
| Documented | Here | Not in customer documentation |
Platform-console permissions are deliberately outside the tenant permission catalogue and can never be represented in a tenant role.
Permissions
| Action | Permission |
|---|---|
| View tenant settings and policies | settings.read |
| Edit tenant settings and policies | settings.manage |
| Configure SLA and deadline policy | sla.configure |
| Capture requirement and framework deadlines | deadline.configure |
| Configure workflows | workflow.configure |
| Manage users | users.* |
| Manage roles | roles.* |
| Manage organisational units | org_units.manage |
| Manage API keys and webhooks | api.manage, webhook.manage |
| Read the audit trail | audit.read |