Workspace Center — the administrator's space

01In a nutshell #sec_655f1659

A workspace is a delegation of governance: an entity administers the access reviews of its own data scope, autonomously, within an envelope set by the subscription.

02The problem: centralized governance does not scale #sec_75c36900

A large group is not an organization, it is an assembly of entities — subsidiaries, brands, regions, business units, often with their own IT teams, their own regulatory obligations and their own calendars.

Offering a single console where everyone administers everything produces three simultaneous failures:

A confidentiality failure. The administrator of the German subsidiary has no reason to see the accesses of the Brazilian subsidiary. In many groups, he is not even allowed to.

A relevance failure. Compliance rules, working calendars, holidays, language, tolerance for exceptions: none of this is common. A single policy is either inapplicable locally or so permissive that it controls nothing.

A failure of appropriation. Governance imposed from headquarters is not exercised. Campaigns are endured, decisions are rushed, and compliance becomes an administrative ritual for which no one is truly accountable.

Conversely, giving each entity its own tool resolves the appropriation issue but destroys everything else: no more consolidated vision, no more common base, no more guarantee that the group's minimum rules are respected.

03The approach #sec_b47e3f95

You do not delegate a tool, you delegate a scope — and you delegate with limits.

The workspace is REVIEWIT's answer to this tension. It is an autonomous governance unit created by the client's central administration (the Subscription Manager), which receives at its birth two inseparable things:

1. A data scope — its boundaries, i.e. what it is allowed to see.
2. A set of functionalities — what it is allowed to do, and with what means.

Within this envelope, the entity truly governs: its campaigns, its rules, its calendar, its administrators, its exclusions, its delegations. No one at the center validates its decisions.

Outside this envelope, it can do nothing: neither see data from another entity, nor activate a capability that has not been granted to it, nor exceed its allocation.

It is the same grammar that governs [RITA](REVIEWIT_Dossier_RITA_v1.0.md): the subscription governs, the workspace chooses within the envelope. This symmetry is deliberate — it is the product's authority model, and it is reused for each new capability.

04What a workspace receives at its creation #sec_0b61439e

The boundaries — the data scope

A workspace is not defined by a list of resources, which would be outdated the next day. It is defined by membership rules evaluated continuously, which allows it to follow the real organization without maintenance.

A scope is composed of three layers:

The attributary conditions are the core of the system. They express the real segmentation of the organization in its own vocabulary: the country, the department, a naming convention, a business directory attribute. A resource or a person that does not meet the conditions does not exist for this workspace — it does not appear in any campaign, any report, any search.

This is not a display filter. It is a visibility boundary, and it is what makes delegation acceptable for a group where entities must not see each other.

A campaign can then further restrict within this scope, never expand it. The workspace's limit is a ceiling.

The functionalities — what the workspace is allowed to do

Each sensitive capability is granted workspace by workspace:

An ungranted capability does not appear: no menu, no screen, no grayed-out button. A granted but capped capability by the subscription remains visible and locked, with the mention of who governs it — a local administrator must be able to understand that the function exists and know who to ask for it.

The allocation

The workspace receives an envelope of credits, and its consumption is monitored. It is the third term of the delegation: a scope, rights, means.

05What the workspace decides at home #sec_855af133

This is where the delegation becomes real. None of these settings go back to the center:

• Its campaigns — scope, policy, population of reviewers, calendar, rules of the game.
• Its certification rules — the compliance policies it retains and the way they are evaluated.
• Its time — time zone, working days, working hours and its own holidays. The deadlines of an entity's reviewers are calculated on that entity's calendar, not on the headquarters' calendar.
• Its administrators — the attribution and expiration of roles on its scope.
• Its exclusions and delegations — with the complete traceability described below.
• Its visual identity and notifications, when the subscription authorizes it.

An entity can thus conduct a strict quarterly campaign while another conducts a lightened annual review, without either having to refer to the other — and without either leaving the common base.

06The second principle: the administrator approves nothing #sec_d7f1d80f

The delegation of governance stops abruptly at the review decision.

No administration surface allows a review decision to be made.

A recertification system is only worth if the decision comes from the person who knows the real use of an access. If the workspace administrator could certify in place of the reviewers, the delegation of governance would become a delegation of self-attestation, and the entity would deliver its own compliance.

All actions in the left column leave an attributed trace. None substitutes the administrator's judgment for that of the reviewer. Decisions are made in the [REVIEW Center](REVIEWIT_Dossier_ReviewCenter_v1.0.md), and nowhere else.

07The four stages of governance #sec_976d1a81

1. Prepare. The campaign wizard builds scope, policy, population, schedule and rules. A principle runs through it: what is not activated does not appear anywhere — a campaign without a contestation period shows no trace of it on the reviewer side.

2. Follow. The list of campaigns gives the real progress. The displayed rate counts the decisions rendered, not the requests marked as completed by an internal mechanism: the bar and the detail on hover tell the same story.

3. Unblock. The Oversight view is the daily screen: reassign a request whose reviewer has left, follow up with a latecomer, open a resource file, go up the chronology of a request, see the other campaigns that carry it. On large volumes, only the displayed lines are loaded — a workspace of one million requests opens like a workspace of a thousand.

4. Report. Reports, alert center, certification file, and exports in four formats with electronic signature of the PDF when the subscription has a certificate.

08The governance settings #sec_cadc5b27

These are the settings that commit the credibility of the system — and for this reason, they are all traced.

The first two share a common grammar, intentionally: a line is a cycle, never erasable data. An exclusion is set and then lifted; a delegation is put in place and then revoked. In both cases, the line remains, with its reason, its justification, its author and its dates.

This is not a refinement: in a delegated model, these are exactly the two levers by which an entity could arrange with the control entrusted to it. What has been removed from the scope and what has been decided on behalf of others are the first two questions of an auditor.

09The roles #sec_8fa09e1f

The roles are carried by the workspace — this is a direct consequence of delegation — and their expiration is applied: an expired role no longer gives access, even if the session was open at the time of expiration.

The auditor profile

The auditor, internal or external, has total read-only access. They do not have an operational dashboard, but a dedicated homepage, the Audit Posture, built around their questions: what does the system cover, what is excluded, who decides on behalf of whom, what decisions are contested, what is pending.

A permanent banner reminds of the consultation mode, the navigation hides the action surfaces, and an application guard prohibits direct access by URL. Exports remain wide open to them: extracting proof is their job.

10A note on the reviewer #sec_e261b41c

The workspace is an administration dimension. It is deliberately not one for the reviewer.

A person owning resources distributed across three entities sees a single queue of work, not three. They never have to choose a scope before working, nor to know that the segmentation exists.

This asymmetry is the indispensable complement of delegation: the segmentation serves governance, it should never be paid for by the people who make the decisions.

11The welcome: RITA #sec_f1d7938c

The welcome of the Workspace Center is not a dashboard but a conversational assistant, RITA, to whom one asks governance questions in natural language: where are my campaigns, who is late, what needs my attention today. Its answers are bounded by the scope of the workspace, like the rest.

RITA never decides and never recommends a decision — this is an architectural constraint, not a setting. See the [RITA file](REVIEWIT_Dossier_RITA_v1.0.md).

12To remember #sec_e40bbe05

The Workspace Center answers an organizational question before being a tool question: how to give an entity the autonomy to govern its access, without giving it the power to exempt itself from control?

The answer lies in three boundaries. The data scope is fixed at the center and impassable. The capabilities are granted one by one. And the review decision remains out of reach of the administration, whatever it may be.

Within these boundaries, the entity truly governs — which is the only known way to get it to really govern.