Admin · Setup

Import workbench

Paste JSON, see exactly what it will do, then apply through an audited database function. Applies run as you, so sign in first.

You are signed out

Previews still work, but every apply will be refused. Go to login.

EnvironmentReadyRoot env loaded

Remote writesTest windowGuarded CLIs

Bootstrap payloadValid1 company, 48 periods

Schema apply50 workbenchespnpm v2:migration-status

Foundation

Access control

Back to the app

External AI briefing

Copy this prompt, paste it into ChatGPT/Claude with your Excel/CSV, then paste the returned JSON here.

Company

PAN: not set — add at /app/company

VAT: not set — add at /app/company

Fiscal yearSource dataNepal VAT/TDS conventionsAmounts in minor units (paisa)I will attach a spreadsheet

Your notes for the AI (column mapping, PAN, special cases)

Examples are templates, not gospel

Repo examples pass structural validation but use placeholder tax IDs and sample amounts. Your accountant should confirm statutory rules and opening balances before you apply in production.

Access Control JSON

Valid

54 lines

{
  "companyCode": "SCC",
  "memberships": [
    {
      "email": "sammancreative@gmail.com",
      "displayName": "CEO",
      "title": "CEO",
      "isOwner": true,
      "status": "active",
      "roles": ["owner", "executive"]
    },
    {
      "email": "admin@example.com",
      "displayName": "Admin Example",
      "title": "Operations Admin",
      "employeeNumber": "SC-EMP-0002",
      "isOwner": false,
      "status": "active",
      "roles": ["admin", "hr_admin", "work_admin"]
    }
  ],
  "permissionOverrides": [
    {
      "email": "admin@example.com",
      "permissionCode": "payroll.read_compensation",
      "effect": "deny",
      "reason": "Operations admin can manage setup but cannot inspect salaries."
    }
  ],
  "approvalLimits": [
    {
      "email": "admin@example.com",
      "domain": "purchasing",
      "amountMinor": 5000000,
      "currencyCode": "NPR",
      "fiscalYearCode": "2083-84",
      "effectiveFromAd": "2026-07-17",
      "effectiveFromBs": "2083-04-01"
    }
  ],
  "delegations": [
    {
      "fromEmail": "sammancreative@gmail.com",
      "toEmail": "admin@example.com",
      "permissionCode": "workflow.decide",
      "startsOnAd": "2026-09-11",
      "startsOnBs": "2083-05-24",
      "endsOnAd": "2026-09-18",
      "endsOnBs": "2083-05-31",
      "reason": "Example short delegation while CEO is unavailable."
    }
  ]
}

Preview

Validation only

Company: SCC
Memberships: 2
Active: 2
Owners: 1
Roles: 5
Overrides: 1
Approval limits: 1
Delegations: 1

2 warnings

Memberships whose email has no Supabase Auth user are reported as unresolvedEmails on apply and skipped; create the user first.
Each listed membership is fully described: roles, overrides, limits and delegations it granted that are not listed here are revoked on apply (by status). An omitted title keeps the stored title.

Resolves each membership by email and upserts it (status, owner flag; an omitted title keeps the stored one), grants listed roles and revokes unlisted active ones, then upserts overrides, approval limits and the delegations those members granted, revoking unlisted ones by status — never deleting rows. Members not in the payload are untouched. Only an owner can grant owner status or the owner role or change another owner's access; the company must keep an active owner; you can never suspend, revoke or de-own yourself or lose admin.manage_access. Emails without a Supabase Auth user are returned in unresolvedEmails and skipped with their overrides, limits and delegations — create the user, then apply again. Re-applying the same JSON is safe. Requires admin.manage_access.

Runs app.apply_import('access_control') as you; the database re-checks your permission and records an audit event.