Company administration

Overview

Company administration* is the administrative core of Ottili ONE. Here, owners and administrators keep the company current, control team and access, secure the account, and make sure every module works in the same company context.

This article is for administrators and describes the most important administration tasks. It builds on the basics from [Company and team](/docs/company-and-team), [Roles and permissions](/docs/roles-and-permissions) and [Account and data security](/docs/account-and-data-security).

Administration happens across two surfaces:

• Ottili Console* ([ottili.one/console](https://ottili.one/console)) – central control for account, company, team, products, billing, credits, usage, API keys, security and settings.
• Workspace* ([dashboard.ottili.one](https://dashboard.ottili.one)) – daily work inside the modules; this is where members, roles and approvals are managed in the company context.

Both surfaces share the same Ottili Auth login and the same company context.

Open company administration

Sign in through Ottili Auth. In the top bar you will find the company switcher* (the building icon) as well as access to Settings* and Team*. Only members with the Owner* or Admin* role see the full administration functions; see [Navigate Ottili Console](/docs/navigate-ottili-console).

Maintain company master data

Maintain company-wide master data under Settings → Company*. These details apply to every member and module of the company:

• Company name* – the operational name shown throughout the product.
• Industry* – helps tune defaults and suggestions.
• Time zone* – used for scheduling, reports and timestamps.
• Currency* – the default currency for financial modules.
• Logo* – uploaded for brand-consistent exports and communication.

Keep these details up to date so reports, invoices and exports are labelled correctly.

Manage team and members

Members are managed through Team*. There you see each member's status (Active, Invited, Locked, Removed), invite people, change roles, lock or reactivate access, and remove members. The full walkthrough is in [Company and team](/docs/company-and-team).

Administrators should review regularly:

• Who has access, and is their status still correct?
• Are pending invitations still valid, or should they be cancelled?
• Have former members lost access promptly?

Assign roles and permissions

Access is controlled by five roles, each bound to permissions:

Only owners and admins may invite members and change roles. Use the lowest role that fits the tasks. The full permission model is described in [Roles and permissions](/docs/roles-and-permissions).

Ownership and security

The person who creates the company becomes its Owner*. The owner role is the highest level of control and should stay limited to trusted people, because it can change billing and settings.

For account security:

• Use strong passwords and enable two-factor authentication (2FA/MFA)*.
• Only invite people you trust.
• Monitor the [Approval Queue](/docs/approval-queue) for unusual activity.
• Keep Ottili Auth as the single identity authority – passwords, sessions and MFA are verified centrally there.

Details on account protection, tenant isolation and audit logs are in [Account and data security](/docs/account-and-data-security).

Approvals and the Approval Queue

Sensitive, outward-facing or high-risk actions go through the Approval Queue*. An action is submitted there for human approval before it runs – this also applies to Ottili AI, which never performs an approval-required action without confirmation. Administrators monitor the queue and approve or reject requests in the company context. See [Approval Queue](/docs/approval-queue).

Switch companies

If you belong to more than one company, switch via the company switcher* in the top bar. The dashboard then reloads with the context of the chosen company; modules, integrations, credits and permissions are evaluated per company. Set a preferred company if you want the right workspace to load on sign-in.

Tenant isolation and data protection

Ottili ONE is company-scoped. Every business object – records, modules, integrations, files, credits and AI context – belongs to exactly one company*, and that company is the tenant boundary (company_id). Isolation is derived from the verified token and enforced deny-by-default; it is never inferred from a membership, a default value, or a request input.

Consequences for administration:

• A member sees only the company they are active in.
• Data from one company is not visible to another.
• Cross-company queries are limited to pure superadmin operations.

Understanding status levels

Individual product features move through defined maturity levels. Each capability carries one of these status labels:

• Live* – available and supported for all eligible companies.
• Beta* – publicly available in a preview state; may still change.
• Private Beta* – available to an invited group.
• In Development* – actively being built, not yet available.
• Planned* – accepted and scheduled, not yet started.
• Concept* – an early idea under review.

Administrators should note the relevant status label when planning modules and automations.

Best practices for administrators

• Keep company master data up to date.
• Assign the lowest fitting role and review roles regularly.
• Revoke access from former members promptly.
• Enable 2FA/MFA for all members with elevated access.
• Monitor the Approval Queue for unusual activity.

Related articles

• [Company and team](/docs/company-and-team) – invite members, assign roles, switch companies.
• [Roles and permissions](/docs/roles-and-permissions) – the full permission model and AI scope.
• [Account and data security](/docs/account-and-data-security) – account protection, tenant isolation and audit logs.
• [Approval Queue](/docs/approval-queue) – human approval for sensitive actions.
• [Workspace and modules](/docs/workspace-and-modules) – how modules bind to the company context.