Three interfaces, three roles

01In one sentence #sec_d281fa46

REVIEWIT does not have a single application with grayed-out menus depending on the role: it has three distinct interfaces, and what one interface does not do, it does not do anywhere.

02Why three, and not one #sec_8338db55

A single application with different permissions would have been simpler to build. It would also have made possible what the product refuses: that a rushed administrator, on a Friday evening, checks off instead of a delayed reviewer.

The separation is therefore not a matter of ergonomic convenience. It is the form taken by the central rule: a recertification decision belongs to the one who makes it. A button that does not exist in any administration interface cannot be clicked by mistake, found by a shortcut, or exposed by an API.

03The reviewer — REVIEW Center #sec_f6563f65

He decides, and he is the only one who decides.

He opens his queue, sees the resources or people he is responsible for, and for each one he makes a decision. The screen does not ask him to guess: it shows him what the policy expected and what was observed.

He only sees what he is responsible for. He does not configure anything, launch anything, or follow up with anyone. His queue is cross-functional to workspaces: a reviewer responsible for access in three entities sees them in a single queue, because his job is to decide, not to navigate an organizational tree.

What he can do when he cannot decide alone — delegate, escalate, consult — is described in the [Reviewer](/tutoriel/relecteur/) workflow.

04The workspace administrator — Workspace Center #sec_0752b59a

He organizes, he does not decide.

A workspace is a governance unit: an entity, a subsidiary, a department, to which the central administration has delegated the governance of its own accesses, within a defined scope.

Its administrator launches campaigns, chooses the scopes and policies, designates reviewers, sets deadlines, follows up, unlocks, and accounts for results. At his disposal: campaigns, sanctification, delegation, reports, the alert center, and the audit of his scope.

What he does not have: a button to approve. All his actions leave an attributed trace, and none substitutes his judgment for that of a reviewer.

05The subscription administrator — Administration Center #sec_5507f0b9

He opens the doors and allocates the resources.

This is the client's central administration. He creates workspaces — the screen says «onboard a workspace» — assigns them their scope and credits, connects data sources, appoints administrators and roles, and monitors everything.

He does not manage the campaigns of a workspace: he created the entity that manages them. It is the same rule one level higher — delegate governance without reserving the right to exercise it instead of the delegatee.

06How the three respond to each other #sec_9e43f33d

The movement goes in one direction only, and it never goes back up.

Administrateur de souscription
    ouvre un workspace, lui donne un périmètre et des crédits
        ↓
Administrateur de workspace
    lance une campagne sur ce périmètre, désigne des relecteurs
        ↓
Relecteur
    rend les décisions
        ↓
La piste d'audit
    conserve qui a décidé quoi, quand, et pourquoi

No one can bypass the level below. A subscription administrator does not make decisions; a workspace administrator does not either.

07And the auditor? #sec_38f77bef

A fourth profile exists: the auditor, with read-only access to everything. They make no changes anywhere—they read the campaigns, decisions, justifications, and audit trail. They have no tutorial workflow because they have no actions to learn: their role is to review what the other three have done.

08To remember #sec_1eaa4598

Three interfaces, three roles, one direction. What a surface doesn’t do, it doesn’t do anywhere—and that’s what makes the promise of accountability credible beyond just a statement of intent.