TENANT GOVERNANCE & OVERHEAD

Platform Administration Guide

Everything you need to set up, configure, and manage a Smart Business 360 tenant.
Target Audience: Platform Super Administrators and Company (Tenant) Administrators.

Platform Administration Overview

Smart Business 360 balances centralized multi-tenant control with isolated tenant administration. Managing a tenant involves configuring company profiles, module entitlements, role-based access control, system settings, approval chains, and automation rules.

The Two Administrator Levels

Administrative privileges are split into two distinct tiers to enforce segregation of duties between system infrastructure and company operations:

Level	Role Scope	Responsible For
Platform super administrator	`PlatformSuperAdmin`	Creating companies, setting module entitlements, managing commercial subscriptions, cross-company oversight.
Company administrator	`TenantAdmin`	Everything inside one company: users, roles, departments, system settings, messaging & ad integrations.

Best Practice: The majority of day-to-day business is conducted at company level. Platform-level actions are deliberately scarce and should be limited to a few administrative accounts.

Platform Administration Guides Catalog

This section comprises five comprehensive administration guides:

Guide	Covers
Multi-company setup	Company profiles, data isolation, module entitlements, subscriptions, company switching.
Users and roles	Creating users, building roles, role scopes, departments, offboarding checklist.
Permission model reference	The complete `Module.Resource.Action` catalog, permission groups, segregation of duties.
System settings reference	Company-wide configuration and tenant operational parameters.
Approvals and automation	Approval chains, approval authorities, automation rules and trigger conditions.

How Access is Decided (4-Layer Evaluation)

Every user action request is evaluated sequentially against 4 distinct security layers. All 4 layers must evaluate to true for access to be granted:

Module Entitlement: Is the requested module turned on for this company tenant?
Permission Check: Does the user's assigned role contain the required Module.Resource.Action key?
Role Scope: What scope of access (Own, Department, Company) does this user hold?
Record Range: Which department or team owns the specific record, and is it in range for the user's scope?

Access Problem Diagnostics Table

When diagnosing permission or access issues, follow this top-down sequential layer diagnostic:

Symptom Observed	Most Likely Root Cause Layer
Module missing from sidebar navigation	Layer 1 (Module Entitlement) or Layer 2 (Module Permission missing from role)
Screen opens successfully, but action button is absent	Layer 2 (User lacks specific Action permission, e.g., Create or Edit)
Screen opens, but no data records are shown	Layer 3 or 4 (Role Scope or Department/Team ownership out of range)
Can see records, but cannot approve document	Layer 2 (`Approve` is a separate action permission key from View)

New Tenant Setup Checklist (15 Steps)

Follow this complete step-by-step checklist when provisioning a new tenant company:

Establish Company ProfileEstablish company record and fill in identity, legal name, domain, and logo.

Set Module EntitlementsEnable the specific purchased modules in Super Admin Console.

Configure File Handling RulesSet attachment size limit (MB) and allowed file extension rules.

Create Company AdministratorProvision the initial company administrator account (TenantAdmin).

Create Custom Roles (Optional)Build customized job roles from permission groups.

Create DepartmentsEstablish organizational department hierarchy.

Provision Users & ScopesCreate user accounts, assign roles, departments, and access scopes.

Open Financial YearConfigure active fiscal year calendars.

Chart of Accounts & VouchersSet up general ledger chart of accounts and voucher categories.

Module Master DataConfigure module properties, items, warehouses, and project master data.

Messaging & Advertising IntegrationsLink WhatsApp Business API, Facebook Pages, Instagram, and ad accounts.

Configure Approval ChainsEstablish multi-tier approval chains and NOC authority limits.

Create & Test Automation RulesSet up trigger-condition-action workflow automation rules.

Import Balances & Historical DataBring in opening ledger balances and historical record archives.

Role Access Verification TestingLog in as genuine test users for each role to verify permissions before launch.

Mandatory Step 15 Note: Step 15 is a mandatory step. The best method is to test each role with a genuine sign-in to catch permission gaps before end users do.

Ongoing Administration Schedule

Maintain tenant health and security by performing tasks according to this operational cadence:

Cadence	Administrative Task
Weekly	Review the approval queue for stalled requests
Weekly	Check integration connection health — review last webhook timestamp and error logs
Monthly	Review automation rule execution logs
Monthly	Review new and deactivated user accounts
Quarterly	Audit roles against the Segregation of Duties checklist
Quarterly	Review module entitlements against active subscription package
Annually	Close the financial year and open the next fiscal period

Critical Security Posture Rules

Configure these parameters intentionally rather than relying on default settings:

Allowed file extensions: Explicitly restrict allowed upload file extensions prior to granting broad user access to the platform base.
Public task links: Keep disabled unless required for a specific workflow. Shared public links do not require sign-in.
Mass messaging restrictions: Strictly restrict mass messaging privileges, as bulk broadcasts incur direct channel cost and regulatory compliance risk.
Salary visibility: Restrict HRM.Employee.ViewSalary and HRM.Salary.ViewAll permissions exclusively to authorized HR role holders.
Approval authority segregation: Never allow the same user to create and approve the same financial voucher or payment document.

On this page