Organisation, identities & permissions

Configure institutions and responsibilities reliably once; each person works with their own language and interaction settings.

Tenant, location, unit, team and responsible function have separate identities, validity periods and explicit relationships; membership of a location does not automatically grant cross-tenant reading permission.

Opening, reorganisation and closure check existing stays, shifts, resources and permission assignments; referenced units are ended, not deleted from history.

Each user has a preferred supported language, additional language preferences, time zone and display options and permitted notification settings. A site default is only an initial value; language is not rigidly enforced based on role or nationality.

Language and profile changes are versioned across devices. Missing translations follow the documented fallback rule without silently changing clinically relevant meanings.

Tenant provisioning uses approved foundation workflows for a dedicated database, credentials and key scopes. The UI shows success only after a complete response; partial provisioning remains blocked and subject to clarification.

Responsibility

Organisation administration manages structure within its own scope, users their own preferences; the platform operator carries out approved provisioning without professional record access.

Automation & AI

Templates and deterministic completeness checks simplify setup. AI may structure organisation descriptions into drafts; tenant creation, responsibility and permissions are explicitly approved. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.

Configure roles to suit the institution without having to maintain complex permissions manually in each module.

A versioned action catalogue contains stable codes, resources, conditions, purpose, competence requirements, risk class and permitted delegation. Translated role names are not permission logic.

Custom roles can combine only offered, approved actions; tenant, site or ward, relationship, purpose, time and competence conditions are not replaced by hiding elements in the UI.

Draft roles and active revisions are separate; dangerous extensions require defined independent approval, display of the impact on affected assignments and policy checks.

M06-A is the authoritative owner of employee competences and their evidence and validity periods. M15 references this approved evidence through the policy port and checks its current validity and responsibility; it neither stores nor approves a second employee competence record. The responsible specialist teams confirm the treatment relationship and scope of delegable permissions. Technical administrators cannot grant themselves authority to prescribe medication.

For external doctors and professionals without an employment relationship, M15 explicitly owns an ExternalProfessionalCredential with issuer, namespace, external reference, evidence revision, validity and an authorised verification decision. Linking to a later employee identity requires verified assignment and a single authoritative competence record; no automatic duplicate is created.

Assignments have a start, end, reason and approving department; short-term representation is not permanent copying of all permissions. Effective permissions can be explained for a specific context without reading restricted data.

Responsibility

Organisation administrators operate within the delegable framework; security and professional approvers are separate; competence is confirmed only by an authorised department; auditors read permitted assignment evidence.

Automation & AI

Templates, expiry warnings and comparison of target and actual states. AI can draft a clear role description from permitted actions; role changes, approval and competence evidence remain deterministic authorised commands. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.

Grant permissions along the actual employee lifecycle and fully revoke them in good time.

Joining, a change of role, representation, extended absence and leaving are versioned processes with source, effective time, responsible people, necessary approvals and verifiable completion.

Account activation, roles and teams, devices, sessions, API and service access and active real-time channels are coordinated with the foundation services; missing partial confirmations remain visible and are escalated.

Online access becomes invalid after revocation within the existing maximum period of 60 seconds; offline leases remain explicitly limited to four hours at most, and critical actions require an online check regardless.

Role changes revoke old permissions specifically. Periodic recertification checks current necessity, expiry and competence; an unanswered review leads to the approved safe process.

Personal employee self-service for one's own leave and preferences in M06 is a narrowly defined capability, not general access to HR data or duty rosters at other sites.

Individual language and accessibility preferences remain consistent during permitted internal changes; retention and deletion on leaving follow the approved data approach, not blanket deletion of historical authorship.

Responsibility

HR initiates within its scope, management and professional leads confirm the need, and identity administration handles faults; exit approval must not grant medical authority.

Automation & AI

Deadlines, provisioning and revocation sequences, and recertifications run automatically in a controlled way; AI may summarise outstanding points. It decides neither hiring or dismissal nor competence grants. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.