Tap a role to toggle which apps it can access.

Toggle whole-app access per role. Changes preview here; nothing is saved until you tap Save.

Add, archive, or recolor roles. Role keys are immutable once created - renaming requires creating a new role and migrating users.

Canonical buckets for the Apps tab. Replaces free-text cluster values.

Single source of truth for department membership. Head-of-department drives HRM and Leave Tracker approval routing.