Organization Administrator Onboarding Guide

Purpose

Restrict who can submit AI use case intake requests to people on your corporate email domain(s). Until at least one domain is configured, you cannot invite team members.

What to do

• Navigate to Admin → Organization Settings.
• Under "Allowed Email Domains", add each domain (e.g. acme.com).
• Save. Multiple domains are supported for multi-brand organizations.

Complete when

At least one allowed email domain is saved on the org.

Purpose

Add the colleagues who will register AI systems, submit use cases, approve workflows, or run reports. Roles drive what each person can see and do.

What to do

• Navigate to Admin → Users.
• Click "Invite User", enter their email and role (OrgAdmin, WorkflowAdmin, Reviewer, Submitter, etc.).
• Optional: bulk-invite via the CSV template.
• Invitees receive a branded email with a one-time setup link.

Complete when

At least one additional active user exists in your organization.

Purpose

Customize the dropdown values used when registering AI systems (departments, vendors, model families, deployment patterns, etc.) so they match your taxonomy.

What to do

• Navigate to Admin → System Register.
• Review the seeded lookup tables and add, hide, or rename values to match your taxonomy.
• Mark unused lookups inactive instead of deleting them.

Complete when

At least one active lookup configuration row exists for your org.

Purpose

Tell the platform who holds each governance role (CISO, CRO, CAIO, DPO, Privacy Officer, etc.). These designations drive who is auto-routed approvals across staged workflows.

What to do

• Navigate to Admin → Organization Settings → Governance Designations.
• Assign at least one named individual to each role you use.
• Roles you don't use can be left blank — only assigned roles appear as approver options.

Complete when

At least one governance designation has a named individual.

Purpose

Set defaults for use case intake: starting risk tier, review cadence, the notification email for new submissions, and which approval stages apply.

What to do

• Navigate to Admin → Use Case Register.
• Set default risk tier and review cadence.
• Set the intake notification email so the right people get pinged on every new submission.

Complete when

Use case register settings are saved for your org.

Purpose

Add an AI system to the registry — vendor model, internal build, agentic workflow, copilot, etc. The registry is the foundation that every other module (controls, risks, monitoring, audits) hangs off.

What to do

• Navigate to System Register → New System (or use the public intake URL printed on /admin/integrations).
• Complete the 5-step intake form. The system is auto-assigned an ID like AI-{ORG_SLUG}-YYYY-###.
• Submit — the system enters the staged approval workflow.

Complete when

At least one AI system exists in your registry.

Purpose

Capture the business use case that consumes the AI system: who, what, why, decisions made, populations affected. Use cases are the unit of risk assessment, EU AI Act scoping, and ISO 42001 impact assessments.

What to do

• Navigate to Use Cases → New Use Case (or share the public intake URL with the requesting business unit).
• Complete the 5-step form covering business context, data, deployment, risk, and stakeholders.
• Submit — the use case gets ID RC-{DEPT}-{###} and enters the staged approval workflow.

Complete when

At least one use case exists in your Use Case Register.

Purpose

Document a control that mitigates AI risk: human-in-the-loop, output review, bias monitoring, prompt logging, vendor SLA, etc. Controls are testable and can be linked to systems, use cases, risks, and frameworks.

What to do

• Navigate to Controls → New Control.
• Complete the 8-step wizard (purpose, design, owner, testing cadence, evidence requirements, framework mappings).
• Submit — the control enters the 7-stage approval workflow.

Complete when

At least one control exists in your control library.

Purpose

Tell the platform how far ahead to warn you about expiring approvals, overdue reviews, and lapsing evidence. The default is 30 days; tune per your operating tempo.

What to do

• Navigate to Admin → Organization Settings → Alert Configuration.
• Set the scheduling warning window (default 30 days).
• Optional: set per-record overrides on individual reviews/policies/datasets.

Complete when

Org alert configuration row is saved.

Purpose

Publish at least one AI policy (Acceptable Use, Generative AI, AI Agent Acceptable Use, Vendor AI, etc.) so users have something to attest to and so the AI Policy Library is not empty when auditors arrive.

What to do

• Navigate to Governance → AI Policy Library.
• Upload an existing policy OR generate a draft with Aslan AI (Enterprise tier).
• Publish — published policies are eligible for attestation campaigns.

Complete when

At least one policy exists in your AI Policy Library.