Tap a role to toggle which apps it can access.

Toggle whole-app access per role. Changes preview here; nothing is saved until you tap Save.

Add, archive, or recolor roles. Role keys are immutable once created - renaming requires creating a new role and migrating users.

Canonical buckets for the Apps tab. Replaces free-text cluster values.

Single source of truth for department membership. Head-of-department drives HRM and Leave Tracker approval routing.

Lets downstream apps (HRM, CC, Leave Tracker) that authenticate by email find the matching Hub user. Required for cross-app permission resolution to work.

Per-app page registry. When an app has pages defined, the Matrix tab gains expandable rows so admins can set permissions per page (e.g. inspector views qcdash.* but only edits qcdash.late).

Approval ceilings per role per scope. Downstream apps (Leave Tracker, Marketing, etc.) read these limits from the user's permission slice and block submissions over the cap.

Temporary role/permission grants that auto-revoke after expiry. A daily 03:00 trigger sweeps expired entries. Install once: run installDailyRevokeTrigger() in Hub Apps Script editor.

Latest 100 audit entries, newest first. Every registry edit, role change, permission toggle, and bulk action is recorded.