Platform teams
Operate tenants, contracts, plans, quotas, domains, readiness, and first-admin onboarding.
A workspace derived from assigned authority
Navigation, records, mutations, exports, and approvals are generated from authenticated tenant and scope grants. A URL or cosmetic role switch cannot create access.
Accountable operations
Material changes carry actor, tenant, time, version, reason, and audit evidence. Independent review is enforced for sensitive publication and approval workflows.