Appearance
Administration & Settings
Where a tenant is configured: who can do what, how approvals route, what the deadlines are, and how the platform connects to the outside world.
Pages in this area
| Page | Route | What it does |
|---|---|---|
| Users & Roles | /admin/users | Accounts, roles, permissions and organisational units |
| Workflow Settings | /settings/workflow | Approval chains, stages and bindings |
| SLA & Deadlines | /settings/sla | Deadline policy, reminders and escalation |
| Taxonomies | /settings/taxonomies | Classification trees and entity tagging |
| Risk Methodology | /settings/risk-methodology | Scoring, appetite and review cadence |
| Notification Providers | /settings/notifications | Delivery channels |
| Alert Policies | /settings/alert-policies | Conditions, recipients and sweeps |
| Integrations | /settings/integrations | API keys and webhooks |
| AI Settings | /settings | Tenant AI configuration |
Documentation for this area
| Article | What it covers |
|---|---|
| Administration overview | The whole domain |
| Users & Roles | Templates, scopes and organisational units |
| Entitlements | What each entitlement unlocks |
| Workflow Configuration | Choosing chain depth, and chain health |
| Tenant Settings | Currency, taxonomies and methodology |
| SLA & Deadlines | Tiers, thresholds and derived versus captured dates |
| Notification Providers | Channels and alert policies |
| AI Provider Settings | Hosted versus bring-your-own-key |
| Integrations | API keys, scopes and the deny-list |
| Security Boundaries | What administration cannot reach |
API & Webhook Administration vs. Operational Integrations
The Integrations page under Administration (/settings/integrations) manages programmatic API keys and inbound/outbound webhook subscriptions for enterprise automation (gated by the api_access entitlement).
Operational telemetry and security integrations are located within the Controls & Assurance domain:
- Integration Catalogue (
/integrations/catalogue): Read-only directory of all 22 catalogued integrations (20 available, 2 planned). - Security Tool Integrations (
/integrations/security-tools): Operational scanner collectors (Tenable, Qualys, Nessus, Nipper) ingesting scanner findings (SFN-) and discovered assets (AST-). - Cloud & Identity Discovery (
/integrations/discovery): Automated inventory sync from Microsoft Entra ID, Azure, AWS, and Prowler.
Administering the system is not the same as exercising judgement within it
Four permissions are never auto-granted, including to Tenant Administrators: tprm.assess, tprm.classify, tprm.decide and assessment.review_self_override.
Whoever maintains the platform is not thereby qualified to approve a material outsourcing arrangement.
Permissions and entitlement
Key permissions: settings.read, settings.manage, sla.configure, deadline.configure, workflow.configure, users.*, roles.*, org_units.manage, api.manage, webhook.manage, audit.read.