Site Admin Guide

The Site Admin runs one institution end-to-end: its look and feel, its departments, its staff, and its documents — all within that single site's boundary.

White-label branding

From Branding, customize how your institution appears to its users (applied instantly, no rebuild):

• Product name — shown on the login page, the sidebar brand mark, and throughout the app.
• Primary & secondary colors — validated for WCAG AA contrast on white. If a color would be unreadable, the editor flags it and blocks saving, keeping the UI accessible (target: WCAG 2.1 AA).
• Logo — provide an image URL. Logos render with aspect-ratio containment (they scale to fit their placeholder, centered) so a wide, tall, or square logo is never stretched, distorted, or cropped.
• Login background — provide an image URL for the sign-in page background; a preview appears in the editor. Clearing it reverts to the platform's default styling. (Invalid image URLs are blocked with inline feedback.)

Branding is white-label-safe: colors flow through the theme so custom brands remain accessible in both light and dark.

Department lifecycle

From Departments, manage your access groups. A department is both an org unit and the boundary that controls who can retrieve which documents.

• Create — name + optional description. Names are unique within the site (case-insensitive); a stable slug is generated once and never changes.
• Rename / edit — update the display name or description (the slug stays fixed as a stable handle).
• Archive — hide a department from active use; archived departments drop out of the default lists.
• Restore — bring an archived department back.

You can also open a department's Members panel to add/remove members and appoint Department Admins. Note: the add-member picker lists only tenant staff — Super Admins never appear and cannot be added to any department.

Staff management

From Users, invite and manage the people in your site.

• Assignable roles: you may invite Department Admins and Users (not Site Admins or Super Admins).
• Initial departments — single-click multi-select: when inviting, pick the new user's starting departments by clicking department chips — no Ctrl/Cmd needed. Selected chips are clearly highlighted, and Select all / Clear all shortcuts appear when there's more than one department.
• Editing existing users: change roles within the hierarchy, and manage memberships. Guardrails protect you from mistakes — you can't change your own role, and you can't remove/deactivate the last active Site Admin of a site.
• Break-glass: deactivate, reactivate, or reset password for any user in your site.

Automated welcome emails

When you invite someone, they immediately receive a welcome email — no more telling new staff to go click "Forgot Password."

• The email greets them, names your institution, and shows a prominent "Set your password & get started" button linking to a secure, single-use setup page.
• The setup link is generated out of band and is used only for that email. It is never shown in the console, returned by the API, written to logs, or stored in the audit trail (Principle III).
• Delivery is best-effort: if the email provider hiccups, the account is still created correctly — just click Reset Password on that user to resend an access link.
• Each onboarding dispatch is recorded as a content-free audit event.

The existing Forgot Password (self-service) and Reset Password (admin) flows are unchanged — the welcome email applies only to brand-new invitations.