Team and roles
Members, departments, role permissions, and routing keys.
Policies route stages to roles, and people hold roles. The Team page is where both sides are managed, together with the departments a route can target.
Members
Administrators add members with a name, an email, and an initial role set. A member appears in routing immediately: any stage targeting one of their roles can assign them. Editing a member’s roles takes effect on the next stage activation.
During the open pilot no invitation email is sent; sign-in connects when Ocean ID (the suite’s Keycloak identity provider) is enforced. The app-side identity, roles, and history are already in place and survive that switch unchanged.
Departments
Departments are the units a workflow can route to. A stage set to A role in a department
needs them to exist: “the manager of the requester’s department” looks for the manager role
inside the department the requester belongs to. Add, rename and delete departments on the Team
page, and set each member’s department there.
Roles as routing keys
A role has a display name and a slug (lowercase, stable, like site_engineer). The slug is
what policies reference in stages, escalation targets, and rule-added stages. Renaming the
display name is free; the slug never changes, and a role that a live policy still routes to
cannot be deleted.
Role permissions
Beyond routing, a role can grant workspace permissions:
| Permission | Lets the holder |
|---|---|
| Create and edit policies | Build routes, edit forms and conditions, archive policies and folders |
| Invite and remove people | Change who is in the workspace, their roles and their department |
| Act on a request on someone else’s behalf | Decide a step assigned to someone else, and reassign a stalled request; every override is named in the trail |
| Manage external approver links | Revoke a link sent to the wrong address, or reissue it to the right one |
| Connect other apps | Manage routes and signing secrets for requests raised by another Ocean 360 app |
| Open the accountability dashboard | See overdue and ageing items across every department |
| Export records and backups | Export decision records in bulk, and the workspace backup |
Nobody can decide their own request, whatever their permissions; the requester can cancel it instead.
Roles in the demo workspace
| Slug | Purpose |
|---|---|
approval_admin | Policy builder access, team administration, escalation backstop |
reviewer | Document review stages |
manager | First-line purchase review |
finance_controller | Finance sign-off stages |
Starting a policy from a template creates any role it routes to that the workspace does not have
yet, such as finance_reviewer or legal_reviewer.