Choose the access your team needs
Owners and administrators can require production screening policies, disable optional AI assistance, and restrict supported capabilities for analyst, developer and viewer roles. Production reading, exports, billing access and approval are enforced at the server, not only hidden in the dashboard.
Policy and organization approval rules determine eligible approvers and which decisions need another reviewer. The administration audit records retained organization, policy, membership, API-key and webhook changes; it is separate from human case decisions and subject evidence.
New case decisions retain the organization approval configuration and revision, restricted approval and production roles, and the screening policy ID, version and review rule used at the time. Case details, review history and audit packets expose this as appliedControls; archive decision records use applied_controls. Older decisions without a snapshot return null. These snapshots exclude notification recipients and document locations, and do not substitute current settings for missing history.
Configure deliberate notifications and document references
Choose an email recipient and opt in separately to monitoring changes and overdue checks. Messages contain opaque event links rather than submitted subject details. Delivery depends on the configured email service; dashboard events and delivery history remain the record of operational state.
Approve exact HTTPS repository hostnames before reviewers add external evidence references. The reference records its repository, document version, provenance, optional SHA-256 and human verification state. SanctionsKit does not retrieve or copy the original document bytes; maintain access and preservation in that repository.
Avoid overwriting another administrator’s changes
GET /api/v1/settings returns governance and governance_revision. A governance update must include the current expectedGovernanceRevision. A conflicting edit returns 409 so the administrator can reload and review the latest controls.
These settings and their administration audit require authorized human sessions. Human-role restrictions do not rewrite API-key scopes; organization-owned keys retain their explicit environment and scopes. API-key scopes do not confer organization administration. Keep keys on the server and give each integration only the scopes and environment it needs.
KEEP BUILDING