Super Admin / Owner

The source manager dashboard supports review, follow-up, independent decisions, eligible closure and rejected-item rework for recovery-security alert reviews.

Filter by status, decision and manager, search text and browse 50 records per page in the source approval-review queue.

Assigned managers can add a follow-up to at most 25 eligible reviews together. This does not bulk-approve, reject or close them.

Inspect advisory same-department workloads, choose an eligible active manager and reassign only open unreviewed items with a reason and history.

Monitor overdue review work and issue scheduled, company-scoped internal reminders using configured policy.

View decision/rework history, verify the recorded audit chain and export bounded formula-neutralized reports within company permissions.

Use company-specific incoming/outgoing identity and the authorized company-mail setup.

Authorize branding changes for the selected company, maintain change history and clear stale context when switching companies.

Company domains, mailboxes, provisioning events and a company-bound mailbox-request service are recorded.

Responsive domain/mailbox/status/request interface uses authorized backend routes and does not expose provider credentials.

Connect the authorized domain and cPanel/mail provider, then confirm mailbox existence before activation.

Reconcile the new account/company portfolio with legacy company permissions before relying on the dashboard.

Create a DNS TXT challenge with a 24-hour validity and verify the registered company domain. Domain verification does not itself create a mailbox.

Company administrators assign mailbox-specific read/send grants. Draft creation and stored inbox access follow the corresponding mailbox ACL.

Create a draft and queue it using authorized mailbox access. Queued is distinct from sent or delivered.

Read stored headers/body with mailbox ACL. A trusted connector importer has tenant checks, message-ID deduplication and per-mailbox sync state; automatic IMAP sync is not connected.

A callable encrypted SMTP adapter and credential-reference validation are present. The existing worker remains disabled for live sends until provider/ownership checks and staging integration are completed.

Operator requeue and retry foundations avoid automatically repeating ambiguous SMTP outcomes. SMTP acceptance is not proof of inbox delivery.

Channel listing, members, creation, grant and revoke are recorded in the source batch; active company context is required.

Company/channel speaking-turn controls use a 15-second lease and a holder-only release.

Initial Flutter sign-in, secure token storage and read-only channel selection exist.

Microphone capture, an independently authorized media service and live audio delivery remain to be implemented.

Incident creation queues recipient-specific inbox entries for eligible active company admins and supervisors.

Separate view/respond/muster grants and revocation; acknowledgement and resolution require response permission.

CLI worker queues eligible open non-drill incidents, with duplicate prevention and transaction locking. Cron activation remains pending.

Company inbox and incident details refresh every 30 seconds while visible; stale warnings and last-check time are displayed.

These delivery channels are not implemented; database polling is a best-effort status view.

Classify the trade movement and its required workflow.

Connect counterparties to the relevant international transaction.

Keep authorized contract records linked to the trade transaction.

Link shipments, documents and operational milestones.

Capture the selected Incoterm and relevant responsibilities for the transaction.

Use configured origin/destination requirements for the selected workflow.

Record clearance steps, documents and authorized status updates.

Link the transaction to its authorized finance workflow.

Connect shipment charges and allocations to the costing workspace.

Carry goods-receipt, cost and ledger references across the trade workflow.

Present summaries only within the viewer’s authorized scope.

Review operational source-linked summaries and exceptions.

Reconcile finance summaries to the underlying ledger.

Review configured trade movement and transaction summaries.

Follow available milestone and carrier-status information.

Review open balances, due dates and recorded follow-up.

Analyze permitted sales and reconciled cost information.

Apply permitted report fields, scope and saved filters.

Enable the format suitable for the particular authorized report.

Summarize defined metrics with traceable source records.

Thirty-day department notice and escalation summaries distinguish generated notices from confirmed external delivery.

Seven-day worker run/failure trends summarize global operational telemetry without exposing other tenants’ approval records.

Health incidents can be manually mapped to a company department. Department counts and the separate 30-day reviewer decision summary have explicit windows and overlap limits.

Limit document categories and access to the departments that need them.

Use authorized file handling for the linked business record.

Provide a print/PDF option where the specific document type supports it.

Enable the right templates for the relevant department and workflow.

Retain the document version associated with an approval or change.

Route the chosen version to assigned reviewers.

Track sensitive document access and lifecycle actions.

Find authorized files by their record and metadata.

Export permitted document-list metadata when the workflow requires it.

Attach supported documents contextually; no universal document menu or format grant.

Private Office Mail attachment storage, hold/review and recovery workflows are documented in their own modules. They do not implement versioning or governance for every Document Center record.

Adapt authorized workspaces to supported screen sizes.

Prioritize tasks and forms relevant to mobile users.

Provide employee-specific requests and published information.

Expose only assigned approval work with applicable limits.

Plan configured delivery channels and permission-aware routing.

Publish supported authorized integration interfaces as they are implemented.

Connect approved shipping, payment and messaging providers.

Deliver configured business messages through approved providers.

One installable app for Android, iPhone and desktop.

Connect assigned rider, sales, collection and supervisor tasks.

Recipients are company users, not public email addresses.

An active department member can send to up to 100 other active members. Department delivery is recorded as one database transaction.

Internal notices identify new messages and uploaded attachments.

Sender upload supports PDF, PNG, JPEG and plain text up to 5 MiB.

Retention previews, legal holds, configured company quotas and independent cleanup review connect to the dedicated governance workspace.

Office Mail stays inside the company database. It does not use SMTP/IMAP or create a company-domain mailbox.

Thread participation and company identity determine which messages an authenticated user can access.

Fetch up to 100 messages newer than the caller cursor from threads they belong to. Polling is distinct from WebSockets or background push.

A thread member can advance their own read position. This is not a delivery confirmation or a read receipt for every participant.

Realtime push, voice/video transport and mobile background delivery require separate infrastructure and validation.

Review attachment usage and recovery-reference inventory inside the authorized company.

Configure no expiry or a 30–3650 day retention period and inspect bounded expiration candidates without deleting files.

Record a reason for legal hold and authorized release. Held attachments are excluded from cleanup previews and approval.

Quota checks use a locked company record during uploads. Companies without a configured quota remain unlimited.

A requester cannot approve their own cleanup request. Approval records a review only; it does not delete a file.

Record backup references and connect them to independent backup verification. A reference alone does not prove a recoverable backup.

Allowed uploads and downloads use company checks, randomized storage keys and SHA-256 verification.

The cleanup worker remains preview-only. Destructive cleanup and actual antivirus/content scanning are not implemented.

A CLI worker creates private checksum-verified copies and records inventory.

A separate worker compares recorded SHA-256 checksums. Matching bytes alone do not prove that a recovery drill will succeed.

Require verified inventory, a restore request and a different authorized approver before recovery execution.

Approved CLI recovery writes a new randomized private recovered file, with tenant/size/hash checks, without replacing the original attachment.

Inspect recovery execution status and stale processing records. Failed/interrupted work needs operator investigation rather than automatic replay.

A second authorized user approves release before an eligible download grant is issued.

A user-bound grant expires after five minutes, is consumed atomically and checks permissions, approvals, path, size and checksum. A failed stream needs a new grant.

Record grant, denial, expiry and integrity outcomes and route authorized review through the security-incident workspace.

Company-scoped recent events and failure counters cover recovery grant creation, redemption and integrity failures without exposing tokens or file paths.

Open a review for a company user and require another reviewer to close it. The source also provides temporary manual recovery-download restrictions.

Escalate an open review to an incident. The opener cannot acknowledge or resolve their own incident; the independent acknowledging admin records the resolution.

Company policy controls acknowledgment and resolution targets. Assignment validates active company and department membership.

A scheduled worker routes overdue assigned incidents through configured active department members at levels 1–5. It records internal notices and dispatch history.

A designated recipient records one response note per dispatch. An escalation response is distinct from resolving the incident.

Formal active department managers receive follow-ups. A different authorized manager decides approval or rejection before permitted closure.

Reopen an eligible rejected review with a reason, preserve prior decisions and resubmit for independent review.

The manager dashboard exposes permitted review, follow-up, decision, close, rework, notice-read and export controls.

New decision/rework actions write chained audit entries; tenant-scoped CSV neutralizes spreadsheet formulas. The chain is not externally anchored and cannot defeat a privileged database rewrite.

An authenticated operations workspace combines personal approval notices, company escalation analytics and sanitized worker telemetry.

Filter personal in-app notices by read/unread state and type. Mark-all-read affects only the current user.

A company can configure an approval threshold of 1–720 hours. The worker uses company policy unless an operator explicitly overrides it.

Open reviews remind their assigned manager; reviewed items awaiting decision notify other eligible independent managers. No automatic approval or reassignment occurs.

Successful executed runs and qualifying failures are recorded. Early startup errors, process kills and failed log writes may not be recorded.

Configure a stale threshold of 15–1440 minutes and failure warnings. Run/failure trends are global operational metadata, not other companies’ business records.

A separate health-monitor job opens deduplicated warning events, records recovery and creates internal notices for authorized active company administrators.

Record who responded to a warning and their note. Acknowledgment does not clear a warning, repair a worker or replay a job.

Configure a 5–1440 minute response target and view a bounded 30-day report based on first acknowledgment during each event lifetime. Historical records use the current policy.

Assign an active company user, require a resolution note and enforce supported state transitions. Manual response state stays separate from observed worker recovery.

Assignment changes and eligible resolve/reopen actions create in-app notices for the assigned active user. Repeated unchanged assignment does not generate another assignment notice.

A permitted reviewer can approve a resolved incident or reject it with a reason. Self-review is denied; rejection returns the manual workflow to investigation.

Health resolution review requires a separately granted health.incidents.review permission. Existing supervisors are not granted this automatically; dashboard access still uses company.update.

Assign an incident to a department in the same company and report investigating, resolved and historical approval/rejection counts. Assignment is manual; approved/rejected counts can overlap after resubmission.

Reviewer decisions have a 30-day summary. The separate department mapping report is bounded and is not represented as a mutually exclusive completion percentage.

A stopped health-monitor job cannot report its own outage. Cron setup and independent uptime monitoring are deployment work.