Tap a role to toggle which apps it can access.

Toggle whole-app access per role. Changes preview here; nothing is saved until you tap Save.

Add, archive, or recolor roles. Role keys are immutable once created - renaming requires creating a new role and migrating users.

Canonical buckets for the Apps tab. Replaces free-text cluster values.

Single source of truth for department membership. Head-of-department drives HRM and Leave Tracker approval routing.

Lets downstream apps (HRM, CC, Leave Tracker) that authenticate by email find the matching Hub user. Required for cross-app permission resolution to work.

Latest 100 audit entries, newest first. Every registry edit, role change, permission toggle, and bulk action is recorded.