Platform · Module
Admin & Policy
One admin console and one policy layer that every app, agent and channel obeys
Admin & Policy gives tenants a single console and a single policy layer: risk tiers, delegation of authority, agent envelopes, data classification, retention and the Company Constitution. Rules are enforced at the Action Bus, not just documented.
One console
The admin console brings together organisation, users, roles, security, subscriptions, agents, domains, and data and compliance settings. Instead of a separate admin area per app, every module's settings live here.
Policy that is enforced
Every Action ships with a default risk tier from its manifest. Tenants can make tiers stricter but never looser. Approval defaults follow a grid of reversibility class by risk tier. The Delegation of Authority (DoA) matrix defines who can approve what: rules by Action family, amount band, currency, workspace, actor type (human or agent), approver role or group, and number of approvers.
An agent policy envelope limits each agent's maximum autonomy per skill family, spend caps, allowed channels, quiet hours and whether disclosure is required. Data classification labels (public, internal, confidential, restricted, pii, sensitive_pii) on fields and files change how exports, model routing, sharing and notification content behave. Retention policies per data category respect legal holds.
The Company Constitution
Planned for Wave 2, the Company Constitution is a versioned document holding brand voice, communication rules, prohibited claims and escalation contacts. Copilot and every agent use it, and outbound AI content is checked against it.
Safer change
A policy simulator runs a proposed rule against the last 30 days of Actions and shows what would have been affected. Conflict detection flags overlapping or contradictory DoA rules before activation. Policies have versions, effective dates, rollback and change approval. Kill switches can stop an agent, a skill, all tenant AI or the platform, with reason and audit.
Conditions start as typed policy rules in code with tenant parameters. A general policy engine is deferred until an architecture decision proves the need. Industry policy packs, policy-as-code tests, DPDP consent manager integration and a security posture score are planned for Wave 3.
Features
What Admin & Policy includes
Admin console shell
Organisation, users, roles, security, subscriptions, agents, domains and data and compliance areas in one place. W0.
Risk-tier defaults
Per-Action risk tiers from manifests; tenant overrides can only be stricter. W0.
Approval defaults by reversibility
Approval rules set by reversibility class and risk tier. W0.
Delegation of Authority matrix
Rules by Action family, amount band, currency, workspace, actor type, approver role or group and number of approvers. W1.
Agent policy envelope
Maximum autonomy per skill family, spend caps, allowed channels, quiet hours and required disclosure. W1.
Data classification labels
Six labels on fields and files that drive export, model routing, sharing and notification content. W1.
Retention and legal hold
Retention per data category within legal limits, with legal hold taking precedence. W1–W2.
Company Constitution
Versioned brand voice, communication rules, prohibited claims and escalation contacts used by Copilot and agents. W2.
Policy simulator
Run a proposed rule against the last 30 days of Actions to see what it would affect. W2.
Conflict detection
Overlapping or contradictory DoA rules are flagged before activation. W2.
Versioning and rollback
Effective dates, rollback and change approval for policy edits. W2.
Kill switches
Stop an agent, a skill, tenant-wide AI or the platform, with reason and audit. W2.
Business hours and holidays
Per-workspace business hours, holiday calendars (India state calendars as data, to verify) and quiet hours. W2.
Policy packs and posture score
Industry policy packs, policy-as-code tests and a scored security checklist. W3.
Workflow
Set a discount approval rule
- 1
Admin describes the rule in plain language.
- 2
AI drafts a typed DoA rule with test cases.
- 3
The simulator shows affected Actions from the last 30 days.
- 4
Conflict detection checks overlaps.
- 5
Admin activates the rule with an effective date.
AI
AI skills and Digital Employees
Plain-language policy drafting
Turns a written rule into a typed rule plus test cases; activation stays human. W2.
Conflict explanation
Explains overlapping DoA rules in plain language; detection itself is deterministic. W2.
Classification suggestions
Suggests pii, sensitive_pii or restricted labels for fields and files. Lowering a label is always human.
Constitution checks
Checks outbound AI content across apps for brand voice and prohibited claims. Always on. W2.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
What is a DoA matrix?
A delegation-of-authority matrix says who may approve which Actions, by amount band, currency, workspace and actor type, and how many approvers are needed.
Can I stop all AI activity at once?
Yes. Kill switches at agent, skill, tenant-AI and platform level are planned for Wave 2, each with a reason and audit record.
Does One3 use Cedar or OPA?
Conditions start as typed policy rules in code with tenant parameters, backed by a relationship engine. A general policy engine is deferred until an architecture decision proves it is needed.
See Admin & Policy in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.