One console, and it refuses in place.
Operations, reconciliation cases, approvals, players, promotions and platform controls in a single audited console — six roles, fifteen capabilities, nine guarded actions.
Back Office, precisely
Operations
Four-machine state on every money command, including the ambiguous ones, with holds, audit chains and the original request bytes.
Reconciliation cases
A difference becomes an authorised correction through a case ladder. There is no path from a screen to a direct edit.
Approvals
Nine action types that need two named people, with separation enforced per request rather than assumed by role.
Players
Standing, gates, limits and wallet, all on pseudonymous references. Opening a document is itself a guarded action.
Promotions
Programmes, grants, award windows and recomputation cases, with dual control on anything that authors value.
Platform
Cells and generations, providers, policy packs, retention and legal holds, the audit log and the kill switch.
Contracts it exposes
- Access
- Six roles · fifteen capabilities · checked per action
- Guarded
- Manual adjustment · wallet unfreeze · break-glass · legal-hold removal · retention shortening · archive deletion · routing · generation activation · chart change
- Audit
- Every action recorded with actor, authority and evidence
What it never does
- Hide a guarded action from someone who lacks it
- Offer an editable balance field
- Let one person move money alone
Every module on this platform is defined as much by what it is forbidden to do as by what it owns. That is what makes a boundary auditable instead of aspirational.
A screen is never a permission. Guarded actions render and then refuse in place with the capability name, so an operator learns why — and who can.
See it running
Every module here surfaces as screens an operator uses on a Monday. Ask for a walkthrough of the ones that decide your week.