Governance is the section a security reviewer asks for and an audit signs off on. It covers personal-data handling, the audit trail, organization and access management, gateway orchestration, third-party integrations, workspace settings, billing entities, SCIM provisioning, multi-workspace identity, and rate-limit policy. Eleven pages — read what your role asks of you.
What Governance covers#
Three logical groups: privacy + compliance (Privacy Operations, Audit & Compliance), identity + access (Organization, Access Control, SCIM Provisioning, Workspaces), and plumbing + policy (Gateway Orchestration, Integrations, Settings, Billing Entities, Rate Limit Policies). They live in one sidebar group because the same operator usually owns all of them, even if they read on different days.
Pages in this section#
Privacy & compliance
Identity & access
Plumbing & policy
Gateway Orchestration
Consumer identity mapping across gateways, credential lifecycle, product scope, circuit breakers.
Integrations
Third-party connections — gateways, ERPs, identity providers, payment processors. OAuth + manual.
Settings
Workspace config — name, locale, currency defaults, provider COGS rates, data retention, theme.
Billing Entities
Legal entities that issue invoices. Currency, address, tax id, billing timezone, default per offering.
Rate Limit Policies
Per-workspace, per-key, per-endpoint throttle config the gateway reads at the edge.
Pick by role#
Different roles read different pages here. Use this table to jump straight to what your seat needs:
RolePages to read
Security reviewerAudit & Compliance, Privacy Operations, Access Control, SCIM Provisioning
Compliance / DPOPrivacy Operations, Audit & Compliance
Finance leadBilling Entities, Audit & Compliance
Platform engineerGateway Orchestration, Integrations, Rate Limit Policies, Settings
IT admin (identity)Organization, Access Control, SCIM Provisioning, Workspaces, Settings
Owner / Admin (everyone above)All of the above. Settings is the gate; SCIM + Workspaces is most often the access ticket.
What is internal vs. external#
Some pages here drive what an end-customer sees on the storefront; others are purely operator-facing. Knowing which is which prevents accidents:
PageAffects end-customer experience?
Privacy OperationsYes — DSR responses + breach notifications reach the customer.
Audit & ComplianceNo — internal log only.
OrganizationNo — operator org + membership management.
Access ControlNo — read-only operator role review.
Gateway OrchestrationNo — internal plumbing.
IntegrationsIndirect — ERP integration affects invoice delivery cadence.
SettingsSome toggles change storefront behaviour (locale, currency defaults).
Billing EntitiesYes — appears on the invoice the customer receives.
SCIM ProvisioningYes — affects who can log into your storefront portal.
WorkspacesNo — operator UX only.
Rate Limit PoliciesYes — the gateway rejects over-limit customer requests.
Changes in Settings and Billing Entities can land on a live customer instantly. Stage them in sandbox first when the change is non-trivial, and read the relevant page's "destructive actions" section before flipping a switch in production.
- Intelligence → COGS & Margins — margin observability and the Margin Guard enforcement that lives alongside it.
- Operations — what to watch when policy changes (alerts, event log, metering health).
- Workspace Admin — member invites + API key management (operator account management lives there).