Who can do what, and the record of it.

A viewer reads. An analyst also imports. A functional manager also assigns exceptions and decides approvals. An administrator manages the organisation's settings; the owner can do everything, including invite the next owner. The automated agents hold a narrower set than the people who trigger them — an agent can never do something the person who ran it could not.

Beyond roles, an owner can grant or withhold each module per person under Module access, so a payroll module is visible to the people who run payroll and nobody else.

Passwords are twelve characters or more and are never stored as such. A second factor is a time-based code from an authenticator app, with single-use recovery codes, or a passkey — the fingerprint or face your device already uses. An owner can require a second factor across the organisation; a member without one is reminded on every page, not locked out of the page where they enrol. Organisations with an identity provider can sign in through it; the provider's roles are mapped to ours once and then followed.

Sessions last eight hours and end sooner when idle. Three wrong passwords lock the account until an administrator unlocks it, and every sign-in, failure and unlock is logged with the address it came from.

Every state change — an import, a decision, an execution, a setting — writes a row with who did it, the record before and after, and the reason where one was given. Administrator actions taken from the platform console write a row your organisation can see. Audit rows are kept for seven years; sign-in events, which contain addresses, for one.

Every figure on every screen can be downloaded with the rows that produced it. Where a language model is used — the Copilot, and the agents that write recommendations in prose — it is handed a bounded context of aggregates and never the database, and your organisation sets a monthly ceiling on that spend. Most of the product never calls a model at all.