Platform · 03

Approvals, companies and environments

How a change is proposed and approved, who may do what, how groups of companies are organized, who holds the keys, and how a company practises before it works for real.

Proposals read as sentences

Every change to a company's records starts as a proposal. The approval screen reads it as one sentence, then says who asked, what it affects, what could go wrong and who may approve it. Technical detail stays collapsed for those who want it.

A member with the right to approve confirms it with a second factor, or rejects it. Proposals that wait 72 hours without a decision expire. An owner can let low-risk actions, such as registering a harvest or moving a lot between the company's own sites, approve themselves.

Proposals can come from people, automations, the company's ERP, the assistant or an outside agent. The approval says where each one came from, and none of them can approve its own work.

Roles

Role	What it may do
Owner	everything, including the administration account, keys, lot rules and who may approve
Administrator	the team, settings and integrations, and every business action
Operator	prepares registrations, deliveries, processing and certificates
Approver	reads and approves; never creates
Auditor	reads records, certificates, reports and the audit log
Viewer	reads

Partners of a company (a producer, a lab, a warehouse of another company) can be invited as guests. A guest sees only the lots that concern them.

Two-factor authentication is required for every approval, and a fresh second factor for the weightiest changes.

Organizations and companies

A group of companies (for example one company per country) is set up as an organization above its companies. The organization keeps one product catalog, sets policies its companies inherit (a company can only be stricter), shows dashboards across the group and runs consolidated reports. Each company keeps its own ledger, team and records. Companies of one organization are connected to each other by default.

Full-screen setup guides take a new organization and a new company through their profile, legal home, team, products and keys before the console opens.

Keys and the administration account

A company's ledger is administered by its administration account, which needs several keys to approve a change. It decides which partners may receive lots, which labs may sign certificates, which partners may process the company's lots, and which version of the ledger software runs. Day-to-day work is approved in the console; the administration account is used for these rarer changes.

The keys are passkeys: digital keys kept on a phone, a computer or a security key, unlocked with a fingerprint, face or PIN. The company's legal home decides how they are held:

	Managed custody	Keys on your devices
Keys	owner passkey, recovery passkey, an A-REX operations key	owner passkey, recovery passkey
Approvals needed	2 of 3	1 of 2
Can A-REX act alone?	never	never (it holds no key)
Can the company act alone?	yes, with both passkeys	yes

Managed custody is offered for traceability records only, and only where the company's country allows it. A company can hand the accounts A-REX keeps for its partners over to its own keys at any time.

Lot rules

The lot rules of a company check every registration, delivery and processing before it happens: which receivers are allowed, which certificates a lot needs, when lots expire, which seasons apply. An owner turns rules on and off, and changes their order and settings, in business words. Each change is a proposal with a preview of what it will do, and it can be undone.

Rules and the ledger software come from versioned releases. When a security update is available, every company page says so, and the owner approves it like any other change.

Sandbox and production

A sandbox is a practice company next to the real ones. It can be filled with a demo story, follows a practice checklist, and can be reset at any time. Every page, report and answer of the assistant says when it comes from a sandbox, and sandbox records are never evidence.

What works in a sandbox can be copied to another company of the organization as a signed setup file. Nothing takes effect on arrival: settings are accepted one by one, lot rules arrive as a checklist, and integration endpoints arrive paused with new secrets.