Organization chart, functional roles and departments
Functional roles say what someone is responsible for — Access Approver, HR Representative — and are a separate axis from access roles. A role can be held for the whole organization or for one department, and this page explains exactly who a role resolves to and what happens when a department has nobody appointed.
Settings → Organization → Chart holds four things: functional roles, seniority levels, departments, and the reporting hierarchy.
A functional role says what somebody is responsible for — "Access Approver", "HR Representative", "Workplace Coordinator". Anything that routes work resolves them by slug to find out who should act (see How a role resolves).
A functional role is not an access role. owner / admin / member
decide what somebody may do in the product (see
Platform admins and impersonation and
Roles and permissions). A functional role
grants no permissions on its own — it records responsibility, so a process can
route work to the right person. Giving somebody the "Access Approver" role
does not let them approve anything they could not approve before.
Departments
A department is a unit a functional role can be held for. Without departments, every functional role resolves organization-wide: one Access Approver, one HR Representative, for everybody.
That is correct for a small organization. It becomes a problem at the size where a business unit has its own approvers, its own HR partner and its own coordinator — because an organization-wide lookup does not fail cleanly. It returns a set of holders, just not the ones responsible for this case.
Create the department. Chart → Departments → Create Department. The slug is what workflows use, so keep it stable — renaming it is a breaking change for anything that resolves against it.
Add its members. Open the department's Members & roles panel. Membership records who belongs to the unit; it grants nothing by itself.
Appoint its role holders. In the same panel, under Roles held for this department, pick a role and a person. That person now answers for this unit specifically.
Somebody can hold the same role organization-wide and for one or more departments. Those are independent appointments: removing one leaves the others in place.
A member's own sheet (Organization → Members) edits organization-wide roles only. The roles they hold for a department are listed underneath, read-only, under Department roles — for example Access Approver · Engineering. Each one links to that department's panel, which is where it is changed.
How a role resolves
Resolution answers "who should act", and it takes an optional department.
| The question | Who is appointed | Who resolves |
|---|---|---|
| The role, no department | Somebody organization-wide | The organization-wide holders |
| The role, no department | Only departmental holders | Nobody |
| The role, for Engineering | Engineering has its own | Engineering's holders, only |
| The role, for Engineering | Nobody for Engineering | Depends on the fallback — see below |
Two rows deserve a note.
Asking without a department never returns a departmental holder. Somebody appointed for Engineering is not an answer to a question that named no unit — returning them would claim standing they do not have.
A departmental holder always wins over the organization-wide one for that unit. This is the shared-services pattern: one person covers everything until a unit appoints somebody of its own.
When a department has nobody appointed
There is no default. Whatever asks the question has to say which of two things it wants:
| Choice | Resolves to | Use it when |
|---|---|---|
| Fall back to the organization | The organization-wide holders, flagged as a fallback | Routing work to a person — process-flow personas and approval steps — plus informational lookups and genuine shared-services arrangements where one person covers every unit |
| Resolve nobody | An empty set | A strict lookup that must fail closed, such as automated access provisioning with no human in the loop, where a blocked step somebody notices is better than a decision routed to somebody without standing to make it |
This is deliberate rather than an omission. The two answers have opposite failure modes — "no person" versus "wrong person" — and which one is correct depends on what is being decided, not on the org chart. A default would settle it silently for every future workflow.
Process flows and approval gates do not resolve functional roles yet.
Today an unstaffed persona or approver falls back to the organization
access role of the same name (for example owner), and a process-flow
instance carries no department. When they start resolving functional roles
they ask with Fall back to the organization: a unit with nobody appointed
escalates to the organization-wide holder, and a flow that names no
department gets the organization-wide holders only.
Seeing what a role resolves to
Chart → Roles → Holders on any role. Pick a department (or the organization as a whole), pick the fallback, and the panel shows what that question resolves to, labelled with how it got there. It opens on Fall back to the organization, the choice work routing makes:
| Label | Meaning |
|---|---|
| Departmental | Appointed for this unit. |
| Organization-wide | Holds the role for the whole organization; no unit was asked about. |
| Organization fallback | Nobody is appointed for this unit, so the organization-wide holders are standing in. |
| Nobody | Nothing resolves. Anything asking this question gets an empty set. |
Organization-wide and Organization fallback return the same people and mean different things. The first was appointed on purpose; the second is a stand-in because nobody was. If you are auditing who can approve what, that distinction is the one to read.
Any member can open this panel — who holds a functional role is
organization-visible. Creating roles, departments and appointments requires
organization admin.
Deleting things
| Deleting | Effect |
|---|---|
| A department | Its members are released, and every role held for it is removed. Organization-wide holders are untouched. |
| A functional role | Everyone loses it, organization-wide and departmental alike. Anything resolving that slug resolves to nobody. |
| A seniority level | Every role and appointment set to it falls back to no seniority, which changes how those role names are displayed. |
Deleting a department removes its appointments rather than converting them to organization-wide ones. That is intentional: the alternative would quietly widen somebody's responsibility across the whole organization as a side effect of tidying up a unit.
The department field on a member profile
A member's profile has a free-text Department field, populated by SCIM from
your identity provider (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department).
That field is informational only. It is not connected to the departments on this page, and it never affects how a role resolves — matching free text against department slugs would produce confident, wrong answers. To scope a role, appoint the holder in the department's panel.