POLICY LAYER — grants authoritative

UI controls are hints only. Authorization is server-enforced via accessGrants, geography, purpose, MFA and SOD. Super Admin does not auto-receive sensitive.read. Permission-denied responses omit resource existence details.

Organization assignment

Required for Organization Admin and News Poster roles.

1. Details

2. Role

No public signup

Only Super Admin can invite administrators.

3. Regions

4. Modules

5. Permissions

6. Expiry

7. Activation

8. First login

Complete

After save, the administrator appears under Pending Activations until the link is used.