Administration
Administration in TriostackOne is centralized: because every app shares one identity model, a role or permission change you make once applies everywhere that person has access — you're not reconciling separate admin panels per product.
This guide covers the things most admins configure early: roles, permission scopes, approvals, access reviews, and offboarding.
1. Understand roles vs. permissions
A role (Admin, Manager, Member) sets a starting permission baseline. Permissions themselves are scoped per app — a person can be a Manager in HRMS (able to approve leave) while only having Member-level access in Finance (able to submit expenses, but not approve them).
Admins can see and edit every app's permission scope for a given person from that person's profile in Settings → Team, without switching between apps.
2. Set up approval chains
Several workflows across the suite depend on an approval chain — leave requests in HRMS, expense reports in Finance, deal approvals in CRM. Each can follow a manager-based chain (approvals follow the org chart and reporting managers) or go to a fixed approver per team.
3. Audit access regularly
The access log under Settings → Team shows permission changes, sign-ins, and app enablement across the workspace, with who made the change and when. In CRM, Audit Logs additionally record every lead, deal, customer, and invoice change with the actor, module, description, and IP address. Use both during periodic access reviews.
4. Offboard a team member
Removing someone from Settings → Team revokes their access to every app at once — there's no need to individually deactivate them in CRM, then HRMS, then Payroll. Their historical records (deals they owned, reviews they completed) stay intact and are reassigned or marked as owned by a former employee, depending on the app.
Best practices
- Give people the lowest role that lets them do their job, and raise permissions in the specific app that needs it rather than making someone an Admin everywhere.
- Review access at least quarterly and immediately after team changes.
- Offboard on the person's last day — one removal revokes access to every app.