You keep it running, and you are the one who cleans up.
Access requests, someone who left three months ago and still has a login, a document nobody can find, and the question nobody can answer: who changed this, and when. Administration is invisible when it works and extremely visible when it does not.
Every record carries who changed what, when, and what it was before.When an administrator acts as another user, it is recorded on their account and on the account they acted as.
Impersonation is never invisible
The reality
The questions you get asked are the ones nobody designed for.
Who has access to what. Why does this person see something they should not. What did this record look like before somebody changed it. Can we get the account of the person who left. These are not exotic requests, and in most systems they are surprisingly hard to answer, because access was built as an interface concern rather than a data one.
Then there is the ordinary grind: onboarding, offboarding, chasing multi-factor, and keeping the scope list in step with the national register by hand.
Access and audit
Roles enforced in the database, not in the interface.
Permissions are applied with row-level security on every table, so what a person can see is decided where the data lives rather than by which screen they happen to be on. A missing check in a component cannot leak a record.
Every change is logged with who, when and the previous value. Multi-factor is available with authenticator codes and backup codes, and when an administrator acts as another user that is recorded on both accounts.
- Row-level security on every table
- Field-level encryption for sensitive values, with searchable hashes
- Impersonation recorded on both the administrator and the account acted as
- Six scope items have no current strategyDetected 2 hours ago · affects 6 of 19 scope itemsBuild TAS
- Two industry licences expire within 30 daysTrainers notified · managers copiedReview
- A recurring finding was raised against Standard 1.3Second occurrence this schedule · linked to RP-011-04Open plan
Keeping it current
The scope list maintains itself.
Training product data is synced from training.gov.au on a schedule, including release history and currency status, so codes, titles and release status are the ones on the national register rather than the ones somebody typed.
Branding, exports and document control are yours to configure. What you cannot configure is the audit trail, which is deliberate — a log an administrator can edit is not a log.
- training.gov.au sync
- Custom branding
- Board-ready exports
Where this connects
For CEOs and directors
Your name is on the registration, so you need warning rather than a report.
Read moreFor compliance managers
Three time horizons at once, and the evidence is in someone else's inbox.
Read moreFor training managers
Strategies that have to survive scrutiny from the regulator and from industry.
Read more
Find out what your last audit would have looked like with a system behind it.
14 days, no credit card, and the Standards are already loaded when you sign in.