Ask AwraIQ about features, pricing, onboarding, login, integrations, security, demos, mobile apps, automation, reports, or support.
Security · Workspace administration
One list of what to fix. The tools to fix it without one super-admin.
The admin command center tells an administrator what the workspace still needs set up, which controls are switched off and which access has gone stale, each item linking to the screen that fixes it. Around it: delegated admins with a written boundary, a preview of what a role change opens before you save it, bulk user actions that need a reason, and setup templates that fill gaps without overwriting what you chose.
Settings · Command center Shown to you: only what you can act on
Setup progress7 / 10
Required defaults1
No tax switched onTax settings
Incomplete controls2
Only one adminUsers
3 people with a conflicting pairConflicts
Stale configuration2
2 API keys unused or unrotatedStale access
4 dormant accountsStale access
Illustration of the screen’s shape. Figures are examples.
The command center
Three kinds of unfinished business, in one place.
A workspace is configured across dozens of screens, and the gaps are invisible from any one of them. The command center reads them all and lists what is left, grouped the way an administrator would triage it. It changes nothing itself: every item links to the screen that owns the setting, which stays the only place it is changed.
Required defaults
The settings everything else reads.
- A base currency, before the first sale.
- A country on the organization profile, which tax defaults and date formats read.
- At least one warehouse and a chart of accounts.
- A tax switched on, or a deliberate decision not to.
Incomplete controls
The controls a reviewer will ask about.
- Admins without MFA, an optional MFA policy, and a workspace with only one admin, or too many.
- People holding a segregation-of-duties conflict.
- No value-based approval rules, and sensitive changes that need no second person.
- No access review in the last 90 days.
Stale configuration
What has quietly gone out of date.
- API keys unused, unrotated, expired or expiring within 14 days.
- Dormant accounts and devices awaiting approval or long unseen.
- A security policy unchanged for over a year.
- Change requests waiting more than a day for a decision.
Each alert carries the permission needed to act on it, so a finance lead with partial admin rights sees the items they could fix and not the ones they could not. A setup progress bar sits above the list. The same summary is in the AWRA mobile app, read-only, with each item opening the web screen that fixes it.
Stale access
Access that has outlived its use.
Five findings an access review asks about before anyone opens a line, on one screen for anyone who can see roles. Acting on one goes through the screen that already owns it: suspend the user, delete the role, revoke the key, revoke the device.
Dormant users
Active accounts nobody has signed in to for 90 days, or ever, once the account is older than a 30-day grace period.
Unused roles
Roles nobody holds, or held only by people who have been deactivated.
Risky combinations
Active people holding a pair of permissions that lets them both raise and approve the same kind of record.
Old API keys
Live keys unused for 90 days, or older than a year whatever their use.
Unverified devices
Devices waiting for approval, and devices still trusted though not seen for 90 days.
Delegated admins
A branch manager who can add a cashier, and nothing more.
A delegated admin manages some users and roles inside a written boundary, so you can keep the Admin role to two or three people without sending every new hire through head office. Granting one needs a reason, which goes on the audit trail, and can carry an end date.
Branch or warehouse
The people of the warehouses you choose, with stock, buying and selling access.
Department
The people of their departments: HR self-service, projects, helpdesk and reports.
Finance
Accounting, billing, payables, receivables and tax access.
Security
Security, device-trust, compliance and audit-log access.
Implementation partner
Inventory set-up, custom fields, automation, integrations and notifications.
They grant only what their type covers and what they hold themselves.
Never the permissions that make more administrators: users and roles, access reviews, temporary access, delegations, security settings, the organization export or billing.
Never an Admin, never their own account, never anyone outside their warehouses or departments.
Never someone who already holds more than they could grant, and a role only when every holder is someone they could manage.
Changing many people safely
See the effect first, record the reason always.
Preview a role change
Before a role is saved, the impact preview lists the permissions added and removed, the menus, API routes and mobile app screens that open or close for the people holding it, any new segregation-of-duties pair, and how many people it affects. It reads the real gates, and applies your plan the way a request would.
Act on many users at once
Resend invitations, suspend, reactivate, transfer department, force an MFA reset, force sign-out or reassign a role for up to 200 people. Each action needs a reason, each person is checked on their own and skipped with a sentence if refused, and the last active Admin is always protected.
Start from your industry
Five setup templates, for retail, wholesale and distribution, manufacturing, NGOs and professional services, propose inventory defaults, workflow packs, starter roles, scheduled reports and notification switches. A preview shows exactly what will change; anything you already chose is kept, not replaced.
Every bulk action writes an audit entry per person carrying the reason and one shared batch number, so the trail answers who did what to whom, why, and in which batch. Each template application is recorded with what it changed and what it kept. Sensitive settings themselves can wait for a second person in the change review inbox, described in the setting that waits for a second person.
What AWRA OpsHub does today
- A command center listing required defaults, incomplete controls and stale configuration, each item linked to the screen that fixes it and shown only to people who can act on it, with a setup progress bar.
- The command center in the mobile app, read-only, and over the API.
- A stale access list of dormant users, unused roles, risky pairs, old API keys and unverified devices.
- Delegated admins of five types, granting only what their type covers and they hold, never the permissions that create administrators, with a required reason and an optional end date.
- The same delegate checks on the web, the API and bulk actions.
- A role impact preview of menus, API routes, app screens and conflicting pairs before a role is saved.
- Bulk user actions for up to 200 people, each with a reason and a shared audit batch, the last active Admin protected.
- Five industry setup templates with a preview, that fill gaps without overwriting what you chose.
More we can add to your workspace
- A weekly command-center digest by email to the administrators, listing what is new since last week.
- Acting on a stale finding from the list itself, such as suspending a dormant user in one click with a reason.
- Delegate types you define, with your own permission groups and placement rules.
- Applying a setup template from the mobile app, beside the preview the API already gives.
- Industry templates for your sector, such as healthcare, hospitality or construction.
Where we point you to a specialist
- We will not let a delegated admin grant the permissions that create administrators. That stays with a full Admin, whatever the type.
- We will not overwrite a setting you chose when a template is applied. Your choice is reported as kept.
The weekly digest and one-click action on a stale finding are the two items most organizations ask for first, and both reuse checks the command center already runs. Tell us which matters and we will come back with a written spec, a timeline and a price.
Around the command center
The controls it points at.
Governance and rolesThe permission model, access reviews, conflicting pairs and temporary access. Enterprise governanceApproval cover, change reviews and the controls a larger organization reviews. Security operationsMFA, sessions, IP rules and the security posture score. Device trustApprove, lock and revoke the devices the stale list flags. Compliance evidence packsUsers, roles, permission changes and delegations in one export for an assessor. Sandbox workspaceTry a new role or approval chain on a copy of your setup first.
Frequently asked questions
What does the admin command center show?
Three lists: required defaults such as base currency, warehouses and a chart of accounts; incomplete controls such as admins without MFA, a single admin or no access review in 90 days; and stale configuration such as unused API keys and dormant accounts. Each item links to the screen that fixes it.
Can the command center change settings itself?
No. It only reads and counts. Every item opens the screen that owns the setting, which stays the one place it is changed.
What can a delegated admin do?
Manage the users and roles inside their boundary: the people of their warehouses or departments, granting only permissions their type covers and that they hold themselves. They can never manage an Admin, their own account, or grant the permissions that create administrators.
What does the role impact preview tell me?
Before you save a role, it lists the permissions added and removed, the menus, API routes and mobile app screens that open or close for the people holding it, any new segregation-of-duties conflict, and how many people hold the role.
Do bulk user actions need a reason?
Yes. Every bulk action needs a reason, which is written to the audit trail for each person with a shared batch number. Each person is checked separately, and the last active Admin is never suspended or demoted.
Will an industry setup template overwrite our settings?
No. A template fills gaps only. Anything you already set is reported as kept, and a preview shows exactly what would change before you apply it.
Help Center
Need a quick answer while you read?
Run inventory, procurement, assets, sales, and field work with approved AWRA guidance for setup, migration, integrations, security, pricing, and support.