Branch Manager App

The source manager dashboard supports review, follow-up, independent decisions, eligible closure and rejected-item rework for recovery-security alert reviews.

Filter by status, decision and manager, search text and browse 50 records per page in the source approval-review queue.

Assigned managers can add a follow-up to at most 25 eligible reviews together. This does not bulk-approve, reject or close them.

Inspect advisory same-department workloads, choose an eligible active manager and reassign only open unreviewed items with a reason and history.

Monitor overdue review work and issue scheduled, company-scoped internal reminders using configured policy.

View decision/rework history, verify the recorded audit chain and export bounded formula-neutralized reports within company permissions.

Present summaries only within the viewer’s authorized scope.

Review operational source-linked summaries and exceptions.

Reconcile finance summaries to the underlying ledger.

Review configured trade movement and transaction summaries.

Follow available milestone and carrier-status information.

Review open balances, due dates and recorded follow-up.

Analyze permitted sales and reconciled cost information.

Apply permitted report fields, scope and saved filters.

Enable the format suitable for the particular authorized report.

Summarize defined metrics with traceable source records.

Thirty-day department notice and escalation summaries distinguish generated notices from confirmed external delivery.

Seven-day worker run/failure trends summarize global operational telemetry without exposing other tenants’ approval records.

Health incidents can be manually mapped to a company department. Department counts and the separate 30-day reviewer decision summary have explicit windows and overlap limits.

Limit document categories and access to the departments that need them.

Use authorized file handling for the linked business record.

Provide a print/PDF option where the specific document type supports it.

Enable the right templates for the relevant department and workflow.

Retain the document version associated with an approval or change.

Route the chosen version to assigned reviewers.

Track sensitive document access and lifecycle actions.

Find authorized files by their record and metadata.

Export permitted document-list metadata when the workflow requires it.

Attach supported documents contextually; no universal document menu or format grant.

Private Office Mail attachment storage, hold/review and recovery workflows are documented in their own modules. They do not implement versioning or governance for every Document Center record.

Recipients are company users, not public email addresses.

An active department member can send to up to 100 other active members. Department delivery is recorded as one database transaction.

Internal notices identify new messages and uploaded attachments.

Sender upload supports PDF, PNG, JPEG and plain text up to 5 MiB.

Retention previews, legal holds, configured company quotas and independent cleanup review connect to the dedicated governance workspace.

Office Mail stays inside the company database. It does not use SMTP/IMAP or create a company-domain mailbox.

Company-scoped recent events and failure counters cover recovery grant creation, redemption and integrity failures without exposing tokens or file paths.

Open a review for a company user and require another reviewer to close it. The source also provides temporary manual recovery-download restrictions.

Escalate an open review to an incident. The opener cannot acknowledge or resolve their own incident; the independent acknowledging admin records the resolution.

Company policy controls acknowledgment and resolution targets. Assignment validates active company and department membership.

A scheduled worker routes overdue assigned incidents through configured active department members at levels 1–5. It records internal notices and dispatch history.

A designated recipient records one response note per dispatch. An escalation response is distinct from resolving the incident.

Formal active department managers receive follow-ups. A different authorized manager decides approval or rejection before permitted closure.

Reopen an eligible rejected review with a reason, preserve prior decisions and resubmit for independent review.

The manager dashboard exposes permitted review, follow-up, decision, close, rework, notice-read and export controls.

New decision/rework actions write chained audit entries; tenant-scoped CSV neutralizes spreadsheet formulas. The chain is not externally anchored and cannot defeat a privileged database rewrite.

An authenticated operations workspace combines personal approval notices, company escalation analytics and sanitized worker telemetry.

Filter personal in-app notices by read/unread state and type. Mark-all-read affects only the current user.

A company can configure an approval threshold of 1–720 hours. The worker uses company policy unless an operator explicitly overrides it.

Open reviews remind their assigned manager; reviewed items awaiting decision notify other eligible independent managers. No automatic approval or reassignment occurs.

Successful executed runs and qualifying failures are recorded. Early startup errors, process kills and failed log writes may not be recorded.

Configure a stale threshold of 15–1440 minutes and failure warnings. Run/failure trends are global operational metadata, not other companies’ business records.

A separate health-monitor job opens deduplicated warning events, records recovery and creates internal notices for authorized active company administrators.

Record who responded to a warning and their note. Acknowledgment does not clear a warning, repair a worker or replay a job.

Configure a 5–1440 minute response target and view a bounded 30-day report based on first acknowledgment during each event lifetime. Historical records use the current policy.

Assign an active company user, require a resolution note and enforce supported state transitions. Manual response state stays separate from observed worker recovery.

Assignment changes and eligible resolve/reopen actions create in-app notices for the assigned active user. Repeated unchanged assignment does not generate another assignment notice.

A permitted reviewer can approve a resolved incident or reject it with a reason. Self-review is denied; rejection returns the manual workflow to investigation.

Health resolution review requires a separately granted health.incidents.review permission. Existing supervisors are not granted this automatically; dashboard access still uses company.update.

Assign an incident to a department in the same company and report investigating, resolved and historical approval/rejection counts. Assignment is manual; approved/rejected counts can overlap after resubmission.

Reviewer decisions have a 30-day summary. The separate department mapping report is bounded and is not represented as a mutually exclusive completion percentage.

A stopped health-monitor job cannot report its own outage. Cron setup and independent uptime monitoring are deployment work.