1

What Admins Control

In Majormatic, administrators control access and policy. The platform controls execution. These are distinct domains that do not overlap — admins configure within governance boundaries, they do not override system rules.

Admins CAN
  • Add, remove, and configure users
  • Assign and modify roles and permissions
  • Configure organisation governance policies
  • Set supervision requirements for the organisation
  • Allow or block apps from the catalogue
  • Set budget limits and spending controls
  • View and export all execution audit logs
  • Configure extended data retention
  • Manage internal apps and app visibility
Admins CANNOT
  • Override platform execution rules
  • Bypass system governance
  • Grant permissions beyond governance limits
  • Disable mandatory supervision requirements
  • Access other organisations' data
  • Waive the Digital Oath requirement for Experts
Key principle: Organisation policy ≤ System governance. You can restrict further than the platform defaults. You cannot remove restrictions the platform has set.
2

User Management

Organisation users are managed through the Admin Dashboard under Organisation → Users.

User Types

Role
Default Capabilities
Notes
Admin
Full organisation management. All permissions. Audit access.
At least one admin required per organisation.
Manager
View team usage. Approve multi-level executions. Set team policies within admin bounds.
Optional. Useful for team-level governance.
User
Execute workflows, review outputs, acknowledge. Limited to permitted apps.
Standard workspace user role.
Reviewer
Acknowledge executions. Cannot execute workflows independently.
Optional. For multi-level approval workflows.

Adding Users

1
Navigate to Admin Dashboard → Organisation → Users
2
Click Invite User and enter the user's email address
3
Select the user's role and configure their permission set
4
The user receives an invitation email to complete account setup

Removing Users

Removing a user immediately revokes their access. Their execution history and audit records remain in the organisation's audit log. User data is retained in accordance with the platform's data retention policy.

3

Permissions & Roles

Majormatic uses role-based access control enforced at the platform level. Permissions are validated on every request — not cached, not assumed, not inherited from session state.

run.execute

Permission to initiate executions. Standard users require this permission.

run.acknowledge

Permission to acknowledge and finalise execution outputs. Required for the supervision gate to complete.

app.publish

Permission to submit internal apps for review and publish to the organisation catalogue.

billing.view

Permission to view wallet balance, execution costs, and transaction history.

audit.view

Permission to view execution audit logs. Typically restricted to admin and compliance officer roles.

admin.manage

Permission to manage users, roles, and organisation policies. Admin role only.

Least privilege principle: Assign the minimum set of permissions each user requires for their role. Do not grant broad permissions as a convenience shortcut.
4

Governance Policies

Admins can configure organisation-level governance policies that apply to all executions within the organisation. These policies operate on top of the platform defaults — they can be more restrictive, not less.

Supervision Requirements

Mandate that all executions within the organisation require acknowledgement — even apps that do not require supervision at the app level. Organisation policy takes precedence in the restrictive direction.

Allowed Engines

Restrict which engine types users in the organisation can invoke. Useful for compliance-constrained environments where only specific workflow types are permitted.

Risk Thresholds

Configure the minimum risk level at which executions require manager or compliance approval. For example: all medium-risk and above executions require a second acknowledgement from a manager or reviewer role.

Execution Limits

Set maximum execution time, maximum input file size, and maximum steps per run at the organisation level. These limits cannot exceed the platform maximums for the account tier.

5

Supervision Control

Enterprise accounts can configure multi-level supervision workflows that reflect the organisation's internal governance structure.

Level 1
User Review

The executing user reviews and acknowledges the draft output. Standard supervision gate.

Level 2 (Optional)
Manager Approval

A manager or senior reviewer must approve the acknowledged output before it is finalised. Configurable by admin for specific app categories or risk levels.

Level 3 (Optional)
Compliance Approval

A designated compliance officer must provide final sign-off. Used for critical risk executions or regulatory outputs in strictly governed organisations.

Supervision levels are configured per app category or per risk level. Not all executions require all levels. The admin determines the threshold at which each level activates.
6

App Control

Admins control which apps are available to the organisation from Appstream and manage internal organisation apps.

Allow/Block Appstream Apps

By default, all approved Appstream apps are available to organisation users. Admins can create an allowlist (only specified apps permitted) or a blocklist (specific apps blocked) to match the organisation's compliance requirements.

Internal Apps

Organisation-specific execution tools built by Expert users within the organisation. Internal apps are visible only to the organisation. They go through the same ABI validation and governance review as public apps, but are not published to the public Appstream catalogue.

Promote Internal Apps

Admins can promote internal apps to appear at the top of the organisation's app list, making domain-specific tools easy to find for all users in the organisation.

7

Billing Management

Enterprise accounts use a shared Total Power wallet. All users in the organisation draw from the same wallet balance. Admins control how that balance is managed and monitored.

Budget Limits

Set a maximum spend per user, per team, or per time period. Executions that would exceed the configured limit are blocked. Users receive a clear error message directing them to contact their admin.

Spending Monitoring

View usage reports broken down by user, app, engine type, and time period. Identify high-spend users or workflows and review whether execution patterns align with intended use.

Billing Rules

Charges only apply after execution completion and finalisation. If an execution fails or is rejected by schema validation, the wallet is not charged. All transactions are recorded with full audit detail.

8

Security Controls

Multi-Factor Authentication

Admins can enforce MFA for all users in the organisation. Users who have not enabled MFA will be blocked from accessing the platform until they complete MFA setup.

IP Restrictions

Restrict platform access to specific IP ranges or CIDR blocks. Useful for organisations that operate from fixed office or VPN IP addresses.

Session Management

Configure session timeout durations for organisation users. Admins can remotely revoke sessions for specific users — useful for immediate access termination when a user leaves the organisation.

SSO Integration

Single sign-on integration is available for enterprise service agreements. Contact your account representative to configure SSO with your identity provider.

9

Execution Limits

Admins can configure execution-level limits that apply to all runs within the organisation. These limits are enforced by the platform at execution time.

Limit
Description
Constraint
Max execution time
Maximum time a single execution may run before being terminated
Cannot exceed platform maximum for the tier
Max input file size
Maximum size of a single uploaded input file
Cannot exceed the app's declared maximum
Max ingestion files
Maximum number of files per execution
Cannot exceed the app's declared maximum
Max steps per run
Maximum pipeline stages in a single workflow execution
Cannot exceed platform maximum
All limits are enforced by the platform. Admins cannot configure limits that exceed the platform maximums for the enterprise tier.

Enterprise Documentation