Documentation · The Lagstyr handbook
Access, people and language
Access holders
Access holders is the roster: who holds governed access, ordered by findings rather than by name, so the first screen is the work. A person appears here only once an access role has been declared for something they hold; a role kind with no declared access meaning grants nothing and is not access. Two markers flag the findings. Past its term means the grant has outlived the expiry the approving case set. Review overdue means the cadence the access role declares has passed without a review. Every clock on the page is the kernel’s.
Access structure
Access structure explains the vocabulary the roster uses.
- Access roles carry a sensitivity — standard, elevated or critical — a grant ceiling and a review cadence. An elevated role always carries a ceiling, and a critical one is reviewed at least every ninety days. Both are refused at the schema, not advised.
- Positions say what each job entitles. A birthright entitlement is granted when somebody joins the position and revoked when they leave it; a requestable one is available to the position and held only after a request.
- Segregation-of-duties rules name the pairs that must not be held together. They are checked when a case is enacted, against the roles the person would end up holding, not against the request.
One person
A person’s Access held page lists what they hold, and the conflicting pairs they hold together. A compensating-control pair may have been approved with one; a prohibited pair should not exist and is a finding. If an access case is open for the person, the page says so: their access changes when the case is enacted.
Access cases
A joiner, a mover or a leaver is an Access case: a plan of grants and revocations that takes effect in one transaction when the case is enacted through an approved proposal. Until then the page says plainly, This case is a plan. Nothing below has happened yet. Afterwards it says the case has been enacted.
A mover’s case has a section headed Carrying across the move: access the person holds that neither position entitles. It survives the move untouched, because individually approved access is not the position’s to take away, but it is part of what they will hold afterwards, and the case shows it.
Administrator access
Administrators answers a smaller question than the roster: who can use the console at all. It shows the current administrator inventory, the history of reviews recorded against it, and recent sign-ins and administrative acts. The inventory can be downloaded as a CSV file, because it is the artefact an auditor asks to be sent.
The page is also where the periodic administrator review is recorded, as a two-person review. You name a second reviewer, choose a disposition — approved, or remediation required — add notes, and record it. Two properties of that review are stated on the page and should be understood before you rely on it:
The review is retained against the inventory shown above. If it changes before you submit, the submission is refused and re-asked against the new one. The second reviewer is a recorded name, not a second authenticated identity.
In other words, the review is a retained attestation bound to an exact inventory. It is not a second sign-in, and the console does not claim it is one.
Changing the language
Every page carries a language selector in its top bar, signed in or not, so that a person who cannot read the current language can still change it. Choose a language and select Change. The console is available in English, German, Spanish, French, Italian, Dutch and Portuguese, shown by their own names. An explicit choice outranks your browser’s preference, always.
Two things stay in English on purpose. A refusal that comes from the kernel is shown verbatim, because it is the record of why something was refused. And the raw state tokens behind status badges are identifiers, not prose.