Governance
Governance is the set of administrative tasks that decide who may do what in tiCrypt. It enables you to create and activate identities, group them into teams that carry resource quotas, classify work into projects with security requirements, and arrange for key recovery if a private key is lost.
Governance is deliberately narrow. It never grants access to research data. An administrator can activate a user, place them in a team, and tag a project, but cannot open a virtual machine, read an encrypted drive, or decrypt a Vault file. Deciding who may hold access and actually holding it are separate powers in tiCrypt, and Governance covers only the first.
Governance contains the following functionality
- Users: create, activate, and manage user accounts, permission profiles, onboarding templates, and per-user resource allocation.
- Teams: define the resource quotas (CPU, memory, storage) that every active user draws against, and manage team membership.
- Projects: classify work with access-controlled project tags, security levels, security requirements, and user certifications.
- Escrow: configure recovery groups, escrow users, and certificates so encrypted data can be recovered when a private key is lost.
- Settings: configure system-wide settings, review the settings change history, and manage custom fields.
Setting up a new deployment
If you are configuring tiCrypt for the first time or taking over administration, work through these in order. Each step depends on the ones above it.
| Step | Action | Guide |
|---|---|---|
| 1 | Configure system settings: organization name, logos, session timeouts, and registration policies | System Settings |
| 2 | Register and activate the site-key admin: one per deployment, and nothing in escrow works without it | Site Key |
| 3 | Create escrow groups and register escrow users: at least three independent groups | Escrow Groups |
| 4 | Create teams: teams carry the resource quotas, and every active user must belong to at least one | Teams |
| 5 | Create projects: organize resources with project tags, security levels, and requirements | Projects |
| 6 | Configure VM hardware setups and images: the compute catalog users draw against | Provisioning |
| 7 | Create user profiles: profiles bundle roles and permissions into reusable templates | User Profiles |
| 8 | Build and activate an onboarding template for each user category: pre-assign profiles, teams, projects, and certifications | Onboarding |
| 9 | Invite users to register, then activate their accounts | Users |
Users
User accounts, permission profiles, onboarding templates, and resource allocation.
Teams
Resource quotas and team membership.
Projects
Project tags, security levels, security requirements, and user certifications.
Escrow
Recovery groups, escrow users, and certificates for key recovery.
Settings
System-wide settings, settings history, and custom fields.