Organization & scope
Tenants, entities, sites, groups, reporting relationships, jurisdiction, timezone, ownership.
Modeling an entity does not establish legal, employment, or tax status.
Administrative Controls
Configure with authority. Change with evidence.
Scope, permissions, versions, approvals, effective dates, worker visibility, integrations, emergency access, audit, and rollback. Administration is deny-by-default and attributable — and every material change is reversible without erasing what came before.
Scope invariant
This page explains the public control model and its safeguards. It is not a configuration console, and availability of any individual control remains evidence- and contract-gated.
Binding administrative limit
No administrative setting creates a hidden surveillance tier.
No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration.
The prohibition applies to native controls, add-ons, plan tiers, APIs, and product-managed integrations alike. There is no administrator role, no enterprise contract, and no configuration path that enables it — this is enforced in the product, not in policy.
Honest limitation: ZoikoTime cannot govern independent third-party systems outside its contract and technical control. What your organization does with data after it leaves the platform is outside this invariant's reach.
Administrative Control Domains
Nine Domains, Each With Its Assurance Boundary
The boundary line matters as much as the purpose. A category label never proves a control is enabled for a specific customer.
Identity & access
Users, roles, service identities, authentication, permissions, delegation, access review.
Role names do not prove least privilege. Effective scope and evidence do.
Policy & rule governance
Schedules, classifications, approvals, break and rest, attendance, exceptions, precedence.
Configuration is not legal advice or a compliance guarantee.
Data & source administration
Source categories, mappings, field use, freshness, quality, retention, failure handling.
No prohibited surveillance data can be enabled here or anywhere.
Integration administration
Providers, service identities, scopes, mappings, write authority, health, revocation.
Connecting a provider does not establish availability or correctness.
Workflow & approval
Routing, eligibility, delegation, escalation, and required human review.
Automation does not make consequential decisions.
Worker transparency
Applicable policy, source, status, correction, and escalation context.
Role- and policy-bound. Never exposes another worker's data.
Audit, evidence & reporting
Versions, approvals, access, changes, exceptions, rollback, reconciliation.
Audit evidence supports review. It is not an audit opinion.
Emergency & recovery
Narrow break-glass, suspension, rollback, reconciliation, recovery pathways.
Emergency access cannot enable prohibited collection or erase history.
Ten non-negotiable invariants
No hidden surveillance tier
The prohibited collection set is unavailable at every tier and configuration.
Deny by default
Absent an explicit current permission and scope intersection, the action is denied.
No silent inheritance
Inherited values, overrides, mandatory floors, and the effective result are all visible.
No silent overwrite
Material changes create versions. Prior approved state stays recoverable per retention policy.
No autonomous consequential outcome
Automation may route or classify under policy. Humans decide payroll, discipline, employment, legal.
No unscoped service identity
Every integration actor has a purpose, owner, scope, credential lifecycle, health, and revocation.
No permanent exception by neglect
Exceptions are time-bound or explicitly renewed. An expired exception stops or enters safe review.
No fabricated source health
Unavailable, stale, partial, or conflicting source state is visible and may block activation.
No hidden worker impact
Material changes affecting collection, classification, review, or visibility trigger governed communication.
No evidence-free claim
Every public control statement carries scope, status, owner, review date, limitations, and evidence route.
Scope, Inheritance & Precedence
The Effective Result Is Always Explainable
An administrator should never have to guess why a setting resolved the way it did. Every layer that contributed is shown, including the one that blocked a local override.
| Layer | Contribution | Effect |
|---|---|---|
Global Organization default | Inherited baseline value for the control. | Applied |
Market / region Jurisdiction context | Regional variation where the product supports one. | Applied |
Mandatory floor Non-negotiable minimum | A security, privacy, or collection-limit requirement that cannot be weakened below this point. | Blocks override |
Entity Legal or operating entity | Entity-level override, permitted only above the floor. | Applied |
Site / group Local context | Local override attempted below the mandatory floor. | Rejected |
Exception Time-bound deviation | None active for this control. | Not applied |
Effective result What actually applies | Entity override, constrained by the mandatory floor. The rejected local override remains visible with its reason. | Resolved |
Local configuration cannot weaken a floor
A site or group override can never silently reduce a mandatory security or privacy control, and can never broaden collection beyond the prohibited set. A rejected override is shown as rejected — not quietly dropped.
Conflict states block unsafe activation
Where sources are incompatible or incomplete, the change enters a conflict state and cannot activate. Administrators can preview which scopes and records a proposed change would affect before approving it.
Scope dimensions: tenant, legal or operating entity, business unit, site, team, worker population, role, jurisdiction, and timezone. Scope lifecycle states: created, active, suspended, merged, retired. Modeling an entity here does not determine its legal, employment, or tax status.
Roles, Approvals & Separation
A Global Role Is Not Global Access
Effective permission is computed, not assigned. The same role in two scopes yields two different results.
The intersection
- Tenant and entity
- Group and worker population
- Purpose
- Role and permitted action
- Data category
- Jurisdiction
- Current policy version
Every one must permit the action. Any single denial denies the whole.
Separation of duties
No self-approval where separation is required. Proposing, reviewing, approving, activating, and auditing are distinct authorities. There is no silent reassignment, and neither workflow automation nor Kairos can decide, approve, or activate an administrative change.
Administrative Change Lifecycle
Nine stages, no instant high-risk activation
| 01 | Draft Reason, owner, and intended scope recorded. | Proposer |
| 02 | Scope review Affected entities, groups, and populations confirmed. | Reviewer |
| 03 | Validation Conflicts, floors, and incomplete sources checked. | System |
| 04 | Simulation Impact preview on synthetic or minimized data. | Proposer & reviewer |
| 05 | Required approvals Eligible approvers, separated from the proposer. | Human only |
| 06 | Scheduled activation Effective date and timezone; staged by cohort where approved. | System, on schedule |
| 07 | Active monitoring Behavior, source health, and worker impact observed. | Operating owner |
| 08 | Correction or rollback Original change preserved; downstream reconciliation tracked. | Authorized human |
| 09 | Supersession or retirement Prior version linked, never deleted. | Governance |
A failed activation enters a safe recoverable state with partial effects visible — not a silent half-applied configuration. And rollback does not erase the original change, nor does it guarantee downstream reconciliation is complete; that is tracked separately.
Policy, rule & schedule controls
CurrentObjective: make workforce-record rules versioned, previewable, and attributable.
- Every policy object
- Purpose, source, jurisdiction context, eligible population, rules, effective dates, owner, review state
- Covered controls
- Schedule, break and rest, attendance, time classification, approval, exception — within approved product boundaries only
- Preview
- Simulation uses synthetic or appropriately minimized data, never live worker records
- Review states
- Conflicting, incomplete, or stale policy sources surface visibly rather than resolving silently
Limitations: ZoikoTime does not provide legal advice and does not guarantee that configured rules satisfy your obligations. Configuration never produces an automatic payroll, disciplinary, or compliance decision.
Integration & service-identity administration
CurrentObjective: ensure every non-human actor is scoped, owned, observable, and revocable.
- Every service identity
- Purpose, owner, scope, credential lifecycle, source health, revocation path
- Connection contract
- Provider, mappings, permitted scopes, write authority, direction, and failure behavior
- Health is visible
- Unavailable, stale, partial, and conflicting states are shown and may block use
- Revocation
- Immediate, attributable, and does not silently orphan in-flight records
Limitations: connecting a provider establishes neither availability nor correctness. A failed integration never broadens access to complete an exchange — it fails visibly and enters reconciliation.
Worker Transparency & Human Authority
Administrative Power Does Not Cancel a Worker Right
Configuration decides how records are made. It does not decide whether the person described by a record can see it, question it, or have a human review it.
Visible to a worker
- Applicable policy context and version
- Source of the record and its status
- Material corrections affecting them
- Available challenge and escalation paths
Governed communication
- Material changes to collection
- Changes to classification
- Changes to review or approval
- Changes to worker visibility
Visibility is role- and policy-bound and never exposes another worker's data. Consultation obligations remain your organization's — this page describes the product's communication mechanisms, not your legal duties.
Consequential outcomes stay human
Automated configuration may route or classify under policy, but payroll, discipline, employment, legal, and worker-rights outcomes require authorized human review outside automatic classification. Deterministic time classification is policy-bound and reviewable — and is not presented as AI.
What Kairos cannot do here
Kairos may retrieve, summarize, and explain governed configuration data where approved. It cannot propose an approval, activate a change, alter a policy version, or hold administrative authority of any kind.
Human-in-Command ControlsExceptions & Emergency Administration
Break-Glass Without Normalising Privileged Access
Emergency authority exists because incidents happen. It is deliberately narrow, expensive to use, and impossible to use quietly.
Break-glass contract
CurrentObjective: allow emergency action while making it fully attributable and self-limiting.
- Required to open
- Strong authentication, named reason, incident or change relationship, narrow scope, and a time limit
- While open
- Monitored throughout
- At expiry
- Automatically revoked, or immediately enters review
- After use
- Post-use review confirms actions taken, data accessed, changes made, residual risk, and required reconciliation
Hard limits: there is no standing unmonitored emergency account. Break-glass cannot enable prohibited collection, cannot produce an autonomous consequential decision, and cannot erase audit history — emergency action remains attributable permanently.
Time-bound exceptions
CurrentObjective: allow a documented deviation without letting it become permanent through inattention.
- Every exception
- Rationale, approver, scope, start and end dates, compensating controls
- Expiry behavior
- The exception stops, or enters a safe review state — it never silently persists
- Renewal
- Explicit and attributable, not automatic
Limitations: an accepted exception is not equivalent to compliance and not equivalent to the control being met. It records that an eligible authority chose to accept a known gap, with an end date attached.
Control Evidence Directory
Public Control Claims, Each With a Status
Planned or contract-specific controls are never described as universally current.
CurrentLimited availabilityUnder reviewPlannedEvidence-gatedSupersededWithdrawn
DomainControl typeProduct areaDeployment contextStatusAccess levelOwnerLast reviewed
Effective-permission model
PUBLICThe deny-by-default intersection and how it is evaluated.
- Domain
- Identity & access
- Owner
- Security
- Reviewed
- 01 Jul 2026
- Status
- Current
Limitation: describes the model, not your configured role assignments.
Inheritance & precedence model
PUBLICSource levels, mandatory floors, overrides, exceptions, and effective result.
- Domain
- Organization & scope
- Owner
- Product governance
- Reviewed
- 04 Jul 2026
- Status
- Current
Limitation: product precedence, not legal precedence.
Change lifecycle & approvals
PUBLICDraft through retirement, with required gates and rollback behavior.
- Domain
- Audit & evidence
- Owner
- Product governance
- Reviewed
- 04 Jul 2026
- Status
- Current
Limitation: rollback does not guarantee downstream reconciliation.
Break-glass control contract
CONTROLLEDAuthentication, scope, time limits, monitoring, revocation, and post-use review.
- Domain
- Emergency & recovery
- Owner
- Security
- Reviewed
- 01 Jul 2026
- Status
- Current
Access: governed request. Security-sensitive detail withheld.
Service-identity register
CONTROLLEDPurpose, owner, scope, credential lifecycle, and revocation per integration actor.
- Domain
- Integration administration
- Owner
- Platform & Security
- Reviewed
- 28 Jun 2026
- Status
- Current
Access: governed request. No customer service-account metadata is public.
Staged cohort activation
PUBLICPhased rollout of a configuration change by approved cohort or environment.
- Domain
- Policy governance
- Owner
- Product
- Reviewed
- —
- Status
- Limited availability
Not universally available. Eligibility is contract- and plan-dependent.
No internal control ID, tenant configuration, or security-sensitive implementation detail appears here. Withdrawn and superseded claims are excluded from current results and structured data, and search terms are never captured in analytics.
Controlled Administrative Controls Review
Request Configuration-Specific Evidence
Availability of an individual control in your plan, region, deployment model, or integration set is contract-gated and cannot be published.
Direct Answers
Eight Administration Questions
No. No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration. No plan, add-on, API, administrator role, or enterprise contract creates that collection set — it is enforced in the product, not promised in policy.