IT Department

Authorized operations users can inspect sanitized worker records, acknowledge warnings and coordinate manual response. These are operational controls, not remote-desktop capability.

A CLI worker creates private checksum-verified copies and records inventory.

A separate worker compares recorded SHA-256 checksums. Matching bytes alone do not prove that a recovery drill will succeed.

Require verified inventory, a restore request and a different authorized approver before recovery execution.

Approved CLI recovery writes a new randomized private recovered file, with tenant/size/hash checks, without replacing the original attachment.

Inspect recovery execution status and stale processing records. Failed/interrupted work needs operator investigation rather than automatic replay.

A second authorized user approves release before an eligible download grant is issued.

A user-bound grant expires after five minutes, is consumed atomically and checks permissions, approvals, path, size and checksum. A failed stream needs a new grant.

Record grant, denial, expiry and integrity outcomes and route authorized review through the security-incident workspace.

Company domains, mailboxes, provisioning events and a company-bound mailbox-request service are recorded.

Responsive domain/mailbox/status/request interface uses authorized backend routes and does not expose provider credentials.

Connect the authorized domain and cPanel/mail provider, then confirm mailbox existence before activation.

Reconcile the new account/company portfolio with legacy company permissions before relying on the dashboard.

Create a DNS TXT challenge with a 24-hour validity and verify the registered company domain. Domain verification does not itself create a mailbox.

Company administrators assign mailbox-specific read/send grants. Draft creation and stored inbox access follow the corresponding mailbox ACL.

Create a draft and queue it using authorized mailbox access. Queued is distinct from sent or delivered.

Read stored headers/body with mailbox ACL. A trusted connector importer has tenant checks, message-ID deduplication and per-mailbox sync state; automatic IMAP sync is not connected.

A callable encrypted SMTP adapter and credential-reference validation are present. The existing worker remains disabled for live sends until provider/ownership checks and staging integration are completed.

Operator requeue and retry foundations avoid automatically repeating ambiguous SMTP outcomes. SMTP acceptance is not proof of inbox delivery.

Recipients are company users, not public email addresses.

An active department member can send to up to 100 other active members. Department delivery is recorded as one database transaction.

Internal notices identify new messages and uploaded attachments.

Sender upload supports PDF, PNG, JPEG and plain text up to 5 MiB.

Retention previews, legal holds, configured company quotas and independent cleanup review connect to the dedicated governance workspace.

Office Mail stays inside the company database. It does not use SMTP/IMAP or create a company-domain mailbox.

Review attachment usage and recovery-reference inventory inside the authorized company.

Configure no expiry or a 30–3650 day retention period and inspect bounded expiration candidates without deleting files.

Record a reason for legal hold and authorized release. Held attachments are excluded from cleanup previews and approval.

Quota checks use a locked company record during uploads. Companies without a configured quota remain unlimited.

A requester cannot approve their own cleanup request. Approval records a review only; it does not delete a file.

Record backup references and connect them to independent backup verification. A reference alone does not prove a recoverable backup.

Allowed uploads and downloads use company checks, randomized storage keys and SHA-256 verification.

The cleanup worker remains preview-only. Destructive cleanup and actual antivirus/content scanning are not implemented.

Company-scoped recent events and failure counters cover recovery grant creation, redemption and integrity failures without exposing tokens or file paths.

Open a review for a company user and require another reviewer to close it. The source also provides temporary manual recovery-download restrictions.

Escalate an open review to an incident. The opener cannot acknowledge or resolve their own incident; the independent acknowledging admin records the resolution.

Company policy controls acknowledgment and resolution targets. Assignment validates active company and department membership.

A scheduled worker routes overdue assigned incidents through configured active department members at levels 1–5. It records internal notices and dispatch history.

A designated recipient records one response note per dispatch. An escalation response is distinct from resolving the incident.

Formal active department managers receive follow-ups. A different authorized manager decides approval or rejection before permitted closure.

Reopen an eligible rejected review with a reason, preserve prior decisions and resubmit for independent review.

The manager dashboard exposes permitted review, follow-up, decision, close, rework, notice-read and export controls.

New decision/rework actions write chained audit entries; tenant-scoped CSV neutralizes spreadsheet formulas. The chain is not externally anchored and cannot defeat a privileged database rewrite.

An authenticated operations workspace combines personal approval notices, company escalation analytics and sanitized worker telemetry.

Filter personal in-app notices by read/unread state and type. Mark-all-read affects only the current user.

A company can configure an approval threshold of 1–720 hours. The worker uses company policy unless an operator explicitly overrides it.

Open reviews remind their assigned manager; reviewed items awaiting decision notify other eligible independent managers. No automatic approval or reassignment occurs.

Successful executed runs and qualifying failures are recorded. Early startup errors, process kills and failed log writes may not be recorded.

Configure a stale threshold of 15–1440 minutes and failure warnings. Run/failure trends are global operational metadata, not other companies’ business records.

A separate health-monitor job opens deduplicated warning events, records recovery and creates internal notices for authorized active company administrators.

Record who responded to a warning and their note. Acknowledgment does not clear a warning, repair a worker or replay a job.

Configure a 5–1440 minute response target and view a bounded 30-day report based on first acknowledgment during each event lifetime. Historical records use the current policy.

Assign an active company user, require a resolution note and enforce supported state transitions. Manual response state stays separate from observed worker recovery.

Assignment changes and eligible resolve/reopen actions create in-app notices for the assigned active user. Repeated unchanged assignment does not generate another assignment notice.

A permitted reviewer can approve a resolved incident or reject it with a reason. Self-review is denied; rejection returns the manual workflow to investigation.

Health resolution review requires a separately granted health.incidents.review permission. Existing supervisors are not granted this automatically; dashboard access still uses company.update.

Assign an incident to a department in the same company and report investigating, resolved and historical approval/rejection counts. Assignment is manual; approved/rejected counts can overlap after resubmission.

Reviewer decisions have a 30-day summary. The separate department mapping report is bounded and is not represented as a mutually exclusive completion percentage.

A stopped health-monitor job cannot report its own outage. Cron setup and independent uptime monitoring are deployment work.