One organization, many countries
Live
A programme attaches to the countries it operates in. Projects attach to the programme by reference and never leave their own tenant, so adding a fifth country adds a country — it does not add an organization to administer, a user directory to duplicate or a second set of permissions to keep in step.
- Country identity
- A country deployment resolves through the canonical country-profile registry. An unrecognised country code is refused rather than accepted and quietly stored.
- Reporting levels
- Reporting is structurally supported at project, country and programme level — the same evidence rolled up, not three separate datasets kept in agreement by hand.
Country access is granted, not assumed
Live
An access grant names one person, one scope — organization, programme, country, study or campaign — one stated purpose, and an expiry. Someone with no grant keeps exactly what their role already gives them; someone with grants is confined to the union of those grants.
What you should know
- A grant can only narrow. It can never widen what a role allows, and it can never reach past the organization it was written in — so a badly written grant cannot become a privilege escalation.
- Every grant carries a stated purpose. A grant nobody can justify at review is a grant that should not have been written, and the field is required for that reason.
- Revocation
- Revocable by the granting organization alone, with the reason recorded. Revocation takes effect immediately.
- Recorded, not implied
- An explicit organization-wide grant can be written down. “Nobody restricted this person” and “someone decided this person is organization-wide” are different facts, and an auditor asks for the second.
Partners get a grant, not a seat
Live
Consortium membership confers no data access at all. Access exists only as an explicit grant naming one scope, one permission list, one purpose and one expiry — approved through the governance workflow by a separate person with decision authority.
- Leaving a consortium
- Revokes every grant that flowed from it, immediately.
- What can never be granted
- No tenant-administration permission can be granted to another organization, under any arrangement.
