Access decisions in a large organisation rarely start from a flat list of users. They start from structure: which business unit someone belongs to, who they report to, and who answers for that unit when an auditor asks. Organization Management in the Tanflow IAM Suite records that structure and uses it to scope access, route approvals and delegate administration.
The structure Tanflow models
Administrators describe business units, departments and locations as a hierarchy that matches how the organisation is run. A bank, for example, might model retail banking, treasury and operations as units, with departments under each and its branches as locations.
Group structures are covered as well. Multi-entity support represents group companies and subsidiaries, each with the separation and shared services it needs. A subsidiary can be kept apart from the parent where that matters, while the services the group shares remain available to it.
Roles and approvals follow the hierarchy
Once the structure is in place, roles, entitlements and approval routing are scoped to organisational units automatically. An access request goes to the requester's manager or to the unit owner, worked out from the structure that has been modelled.
The same model applies when people move between units. When someone changes team, Tanflow recalculates their entitlements, grants the new access and revokes the old. Their next request then routes to the approvers of the unit they now belong to.
A named owner for every unit
Every unit in the model has an owner. That gives each part of the organisation one person who is responsible for certification and audit. Certification campaigns can be scoped by unit, so a review can cover one business unit at a time, and each certify or revoke decision is attributed to the person who made it.
Ownership also goes below the unit level. Each entitlement in the catalogue has a named owner, and each grant has a recorded reason. Someone reviewing a unit can see who is responsible for the unit and who is responsible for each permission held inside it.
Handing administration to a business unit
In a large organisation the central identity team tends to become a queue. New contractors, attribute corrections and group changes all wait for the same few people. The common workaround is to hand out full administrator rights more widely, which gives platform-wide power to people who only needed to look after one department.
Delegated administration in Tanflow gives a unit administrator control over a defined group of people without handing them the whole platform, and central oversight stays in place. An administrator for a Pune office, for instance, can be given control over the people in that office's unit.
Some practices keep delegation safe:
- Delegate along the units already modelled, so each unit administrator's scope matches a part of the organisation that has a named owner.
- Keep platform-wide administration with the central team, and give unit administrators only their own people.
- Define segregation-of-duties rules for conflicting combinations, such as creating a vendor and approving its payment, so Tanflow blocks or flags them at request time in every unit.
- Look at what unit administrators do. The IAM Suite audits administrators' own actions, and each event is recorded with actor, target, timestamp and source.
Evidence for access reviews
For organisations working to ISO/IEC 27001:2022, unit-scoped approvals and certification campaigns give evidence for Annex A control A.5.18 on access rights. Tanflow's mapping for that control covers approved requests, review in certification campaigns, and removal of access when someone changes role or leaves. The IAM Suite is designed to align with the control; certification is still an assessment of the organisation as a whole.
Reports export as CSV or PDF for audit submissions. When an auditor asks who approved a particular grant in a particular unit, the answer is an approval record routed through the unit structure and attributed to a named person.