Departments and Sites

Departments

What. A tree of departments inside the org. Each has a code, name, head, members, and may own processes and documents. Where. /departments.

List page (tree view)

The departments page is a hierarchical tree. Click a node to expand its children. Each row shows code, name, head avatar, and counts of processes

• documents.

Top-right buttons:

• New Department - root or sub-department (sub-department is created by clicking ⋯ on a parent → Add sub-department).

Detail page (5 tabs)

/departments/<id> has tabs:

• Overview - head card with Change head button, KPI tiles for members / processes / documents / sub-departments.
• Processes - every process owned by this department.
• Documents - every document owned by this department.
• Sub-departments - child departments.
• Activity - change feed for this department.

Plus a Members (n) section on the Overview tab with an Add member button (admin / dept head only).

Adding a member

1. Open the department detail.
2. Click Add member.
3. The dialog opens. Type a name or email - the field autocompletes against existing org members.
4. Pick Role (Member, Lead, Reviewer, etc.).
5. Click Add member.

Changing the head

1. On Overview, click Change head.
2. Pick a member from the dropdown (must already be a member of the department).
3. Confirm. The previous head is demoted to a regular member; the new head is promoted.

Approval impact. When a department's head changes, any pending approvals where the department head is a step do not re-target - the already-materialized approval row keeps the original approver. New submissions get the new head.

Sub-departments

A department's parent_id references another department. The closure table department_ancestors is maintained automatically - that's what the cross-org-leak fix relies on.

Test it

• Open /departments. Tree renders with at least 1 root.
• Click a root → expand. Counts match the detail page tab counts.
• Open detail page. Members header count matches the body's Members list count (head excluded if filter excludes head).
• Add a member by email autocomplete.
• Change the head and confirm the previous head is demoted to member.
• Create a sub-department under DG Office.

Sites

What. Physical locations or business units. Sites can scope risks and audits. Where. /sites.

List + detail

The list shows site name, address, type. Click a row to open the editor where you can edit metadata.

Sites are referenced by:

• Risks (risks.site_id)
• Audits (filter audits by site)

Sites do not currently have approval flows or members.

Test it

• Create a site with name + address + type (HQ, factory, warehouse).
• Edit the site's address.
• Pick a risk and assign it to the site. The risk detail page shows the site name.