§ 1
In brief
Group
Retail group
Legal entity
Stores
Region
Region West
a role here reaches this region and all its stores
role at a unitStore
Store
Region
Region Kyiv
Legal entity
Online
Systems
Keys and webhooks
a key is scoped to a unit, like a person’s role
Audit trail
Every action recorded
with the role and the unit
- A role at a unit
- Access is one role at one unit and its subtree. A person may hold several and switch between them.
- Delegated and decided
- Access is granted by those who may; a request is decided by someone other than the person asking.
- Separated duties
- Whoever sets routing does not approve its exceptions; whoever manages access does not grant it to themselves.
- Systems connect too
- The company’s systems use API keys scoped to a unit and receive events through webhooks.
§ 2
In detail
2.1
Units, as in a directory
A legal entity, a region, a store, an online channel, a marketplace seller: each is a unit with a parent, and a unit sees and steers the units under it.
Demo scene 1
The units of the demo group
The retail group’s units by kind.
| Kind | Units |
|---|---|
| Group | 1 |
| Legal entity | 2 |
| Region | 4 |
| Store or channel | 24 |
2.2
A role at a unit
A grant gives a person one role at one unit, and the unit’s subtree with it. A person may hold several grants and switch between them; each action is taken in one of them and recorded with it.
Demo scene 2
Roles at units on the demo stand
The active grants of the demo group, by role and unit, and how many units each one reaches.
| Role | Unit | Units reached |
|---|---|---|
| Hierarchy administrator | Yarmarok Retail Group | 31 |
| Payments manager: routing and costs | Yarmarok Retail Group | 31 |
| Finance controller: reconciliation | Yarmarok Retail Group | 31 |
| Online operations | Yarmarok Online | 5 |
| Risk and fraud | Yarmarok Retail Group | 31 |
| Contracts and access manager | Yarmarok Retail Group | 31 |
| Pay page designer | Yarmarok Online | 5 |
| Integrator | Yarmarok Retail Group | 31 |
| Read-only view | West | 6 |
2.3
Delegated, decided, separated
- Separation of duties is checked when a grant is made: whoever configures routing does not approve its exceptions, and whoever manages access does not grant it to themselves.
- A request for a role is decided by someone other than the person it is for.
- Every action in a cabinet goes to the audit trail with the role and the unit.
Demo scene 3
Access on the demo stands
Active grants of the retail group, requests waiting for a decision, and entries in the audit trail of both stands.
Active grants
9
Requests waiting
3
Audit trail entries
700
2.4
Systems connect too
An order system, a bonus system, an accounting system and a reporting tool reach the platform through API keys scoped to a unit, with the secret shown once, and receive what happens through webhooks they subscribe to by event type — signed, delivered at least once and retried. Every call and every delivery is in a log an integrator can read.
Demo scene 4
Systems on the demo stands
API keys, webhook endpoints and deliveries recorded on both stands.
API keys
11
Webhook endpoints
8
Deliveries recorded
1,942
2.5
One portal, two assemblies
The retail group and the payment provider of the demo share every screen and differ in what their data makes of it: the group has no payouts and no onboarding, because its banks settle to its own accounts; the provider’s merchants have no acquiring terms of their own, because the provider holds their money and charges them by its tariff.
§ 3