Governance & Administration
Governance & Administration sets who may act and what they may do. Workspaces set the scope. Grants and policies bound access. Reviews and audit show what needs attention.
Boundary
Governance & Administration owns Workspace scope, grants, policy, reviews, and audit. Use this territory when someone needs access or a rule blocks work. Return here when a grant needs review. Day-to-day preferences belong to Work & Settings. Each Capability owns the result of its actions. Governance owns the access checks and who may repair refused work.
Services
Governance & Administration connects people and work to grants. Policy sets the checks on each grant. Reviews revisit standing access. Audit helps trace each decision and its effect.
| Service | Use it to understand |
|---|---|
| Workspaces and membership | Organization scope, Members, Groups, and Join Requests before granting actions. |
| Roles and capability bundles | Temporary Role access and grants that follow a Group roster. |
| Tags, policy, and field access | Tag values, required Purposes, and the fields a caller can see. |
| Approvals, sharing, and controls | Review decisions, resource shares, Role conflicts, and spend limits. |
| Access reviews and audit | Standing access, recertification, evidence, and API-key administration. |
Start here
Use Administer workspace access to take a Governance request through grant checks. Verify the access that results. For hidden fields, start with the Field Access model. For a grant that should end, use the Access Review model. Find the failed check before changing a broader grant.
The Console opens Governance at /governance/overview. The Console guide owns navigation and sign-in. The API reference owns HTTP calls, permissions, errors, and responses. Start with the Role request contract when the needed grant is temporary. The API guide explains how to call that contract outside the Console.
Next steps
- Security guidance explains sign-in and trust checks when the failure occurs before Governance access checks.
- Records & Lists owns the Records a permitted caller reads and changes.
- The Action run recovery workflow follows a writeback result after Governance repair authority has been checked.