Kriton™ AI Advisor · Admin Mode
Govern the people, policies, sources and systems behind AI accounting work.
Admin Mode helps authorized teams configure access, policy, sources, integration, provider, evaluation and lifecycle controls — while keeping every consequential change reviewable and attributable.
- Scoped access
- Reviewable change
- Source governance
- Provider controls
- Audit evidence
Why Admin Mode
A governed operating system, not a settings page
Institutional control over people, policy, data, sources and systems — authority stays bounded, and every consequential change stays reviewable.
Bounded authority
Every control carries a scope, an owner and defined decision rights. Administrative reach is never unbounded.
Reviewable change
Consequential changes are proposed, assessed, reviewed, approved, released and monitored — never silently applied.
Attributable evidence
Administrative work is recorded so it stays accountable and reconstructable, without exposing records or implying guarantees.
Professional boundaries
Configuration supports governed work. It does not replace legal, accounting, tax, audit or security judgment.
Administrative Control Map
Nine governed control domains
Each domain opens to scope, owner, decision rights and required visibility — never a bare feature list.
- 01
Organization & tenancy
Organizations, workspaces, environments and business units — bounded, owned, and separated at the tenant boundary.
- 02
Identity & access
Users, groups, service identities, roles, scopes and sessions, reviewed on a defined cadence.
- 03
Knowledge governance
Sources, ontology concepts, mappings and RAG bundles governed as admitted knowledge, not free-form content.
- 04
AI capability
Models, providers, tools, prompts and evaluation gates bound to an approved purpose and environment.
- 05
Data lifecycle
Classification, retention, legal hold, deletion, export and disclosure obligations across the record's life.
- 06
Operations
Runtime health, incident state, degraded modes, provider status and escalation paths.
- 07
Policy & configuration
Draft, assessment, review, approval, release, monitoring and retirement of every policy object.
- 08
Integrations
Inbound and outbound connections, authorization scope, data path and revocation.
- 09
Audit & evidence
The append-only administrative record: who changed what, under which authority, and when.
Identity & Decision Rights
Who may view, configure, approve and administer
Roles are bound to scope and authority. No role inherits privilege implicitly, and no role approves its own grant.
- Organization Owner
- Holds ultimate accountability for the tenant. Assigns and revokes administrative authority.
- Platform Administrator
- Configures workspaces, environments and platform-level settings within an approved scope.
- Identity Administrator
- Manages users, groups, roles and session policy. Cannot approve their own privilege grants.
- Source Governance Administrator
- Admits, versions and retires sources and their authority basis.
- AI Model Administrator
- Manages model and provider enablement, evaluation gates and production promotion.
- Integration Administrator
- Authorizes connections, defines data paths and revokes access.
- Privacy / Retention Administrator
- Sets classification, retention windows, legal hold and deletion policy.
- Auditor / Read-only Reviewer
- Full read access to the administrative evidence trail. No write authority at all.
Policy & Configuration Lifecycle
Propose, assess, review, approve, release, monitor, retire
Every policy object moves through the same governed path. Nothing reaches production by edit alone.
Delegation & temporary access
Every delegation action is scoped, time-boxed and recorded against the authority it supports.
Scope is defined at grant time; it never widens by inheritance, import or role change.
Standing delegation expires on a defined boundary and requires explicit renewal.
Break-glass and maximum durations are explicit — no indefinite temporary access.
Sensitive delegation requires independent approval and is disclosed to the tenant owner.
Owner or authorization holders can revoke immediately; active sessions are invalidated when supported.
Separation of duties · dual control required
- Privileged role assignment
- Requires a second, independent approver.
- Source authority promotion
- Requires source governance plus an owner review.
- Model / provider production enablement
- Requires a passing evaluation gate plus approval.
- Retention reduction or deletion override
- Requires privacy authority and a recorded justification.
- Emergency access
- Documented trigger, defined duration, post-event review.
Source, Ontology & RAG Governance
Governed knowledge administration, end to end
Authority, rights, applicability, version and approval travel with every source, mapping and bundle.
- 01
Register & assess source
Source publisher, authority basis, jurisdiction and version are recorded before admission.
- 02
Ontology & mapping
Concepts, relationships and organization mapping are governed and reviewed.
- 03
RAG bundle assembly
Eligible, versioned sources are assembled into the bundle a question may draw on.
- 04
Evaluation
Bundle quality, coverage, conflict handling and currency are tested before release.
- 05
Release & revalidation
Released with a review interval; revalidation is scheduled, not assumed.
Model, Provider, Tool & Integration Governance
Connected capability, bounded on purpose
- Approved purpose
- Every capability is enabled for a specific, recorded purpose — not enabled in general.
- Environment
- Development, staging, and production are separated, with distinct approval paths.
- Data path
- Where data travels, what is retained upstream, and under which contractual terms.
- Limits
- Rate, context, cost and concurrency limits are bound at the capability, not left open.
- Evaluation
- Benchmark passes, quality thresholds, and regression checks gate promotion.
- Lifecycle
- Proposed, piloted, approved, monitored, deprecated, retired — with a record at each stage.
Privacy, Retention, Audit & Evidence
Data lifecycle and attributable record
- Data classification
- Applied at capture; drives retention, access and disclosure downstream.
- Purpose limitation
- Data is used only for the purpose it was governed for. Repurposing requires new approval.
- Retention
- Windows are set per class and per tenant, disclosed rather than silently applied.
- Legal hold
- Suspends deletion for a defined matter, with its own approval and release record.
- Deletion & export
- Both are governed actions. Exports carry an integrity signature; deletions are recorded.
Change Management · Versioning & Rollback
Draft through retirement, nothing applied silently
Draft
Change is authored with an owner, scope and stated intent.
Impact assessment
Affected scopes, roles, sources and downstream effects are identified.
Review
An independent reviewer examines the change against policy.
Approval
Recorded decision with reasoning; separation of duties applies where required.
Scheduled release
Applied at a defined boundary, never silently at write time.
Monitor
Post-release observation against expected effect.
Rollback
A prior version can be restored; the rollback is itself an appended event.
Supersede / retire
The prior state is preserved and marked superseded, not deleted.
Incident, Degraded & Emergency Controls
Degraded and unknown states are never shown as success
Degraded & incident states
- Provider degraded
- Reduced capability is surfaced to the user, not masked as a normal result.
- Authorization expired
- The action is refused and the expiry is stated plainly.
- Source unknown
- An answer is not assembled from a source whose authority cannot be established.
- Security event
- Affected scope is isolated and the incident state is disclosed to the tenant.
Emergency & recovery states
- Policy conflict
- The conflict is surfaced for human resolution; neither policy silently wins.
- Emergency access
- Time-boxed, purpose-limited, and reviewed after the fact.
- Rollback required
- The prior approved configuration is restorable, with the restore recorded.
- Unknown provider state
- An unverified provider state is treated as unavailable, never as success.
Synthetic Administration Workspace
See the control plane without touching production
Synthetic organization, users, sources, policies, providers and evidence only. No real names, credentials or customer data.
A synthetic control plane showing configuration state across governed domains.
| Control | Object | State | Evidence |
|---|---|---|---|
| Identity review cycle | Q3 attestation | Approved | Completed · 2 approvers recorded |
| Source admission | IFRS bundle v4 | In review | Awaiting source governance approval |
| Model promotion | Advisor model · staging | Blocked | Blocked — evaluation gate not passed |
| Retention policy | Working papers · 7y | Approved | Approved · disclosed to tenant owner |
| Integration scope | Practice management | In review | Scope reduction proposed, in review |
Synthetic demonstration data — not a professional conclusion, and not derived from any customer tenant.
Architecture Relationships
How Admin Mode connects to the rest of the platform
Platform Overview
Admin Mode configures the governance plane every other layer operates within.
Accounting Ontology
Admin Mode governs which concepts, mappings and versions are admitted.
RAG Source Bundles
Bundle eligibility, assembly and revalidation are administered here.
Evaluation & Benchmarks
Gates defined in Admin Mode determine what may reach production.
Enterprise Integrations
Connection scope, data path and revocation are authorized here.
Ask Accounting Questions
The capability, sources and limits available to a question are set here.
Learning & Practice Mode
Practice scope and content admission follow the same governance.
Review Mode
Reviewer roles, decision rights and evidence capture are configured here.
Direct Answers
Frequently asked questions
A governed operating layer for administering people, policy, sources, capability and lifecycle across the platform. It configures how governed work happens — it does not perform accounting work itself.
Related sections
