How the pieces fit together
The app is built from a small set of objects. Each one owns exactly one job. Once you know which object owns what, the settings area stops being a maze.
The objects
| Object | What it owns |
|---|---|
| Organisation structure | One tree, shared by everything. Accountability, reporting roll-up, and the scope that access grants point at. |
| Workspace | A folder of registers, plus a bundle of default settings that new registers copy. |
| Risk register | The unit of configuration — methodology, appetite, layout, baseline access. |
| Risk | The record itself. Inherent, residual and target scores. |
| Control | A safeguard, defined once in a library, reusable across many risks. |
| Treatment plan | How planned controls actually get built, optionally as Jira work. |
| Custom asset list | The things risks are about — applications, vendors, processes. |
| Custom field | A question you can be asked, and which answers are legal. |
| Factor | How one answer becomes a number. |
| Assessment methodology | How those numbers combine into a score. |
| Layout | Where a field appears, at which stage, and who may change it. |
| Group and role | Who people are, and what a role lets them do. |
The four layers
Every setting belongs to exactly one layer, and each layer answers exactly one question.
| Layer | The question it answers | Examples |
|---|---|---|
| 1 — Library | What exists in the world? | Asset lists, controls, fields, factors |
| 2 — Composition | How do these combine into a number or a bundle? | Assessment methodology, framework pack |
| 3 — Placement | Am I asked this, where, when, and who may change it? | Layout, stages, field access |
| 4 — Record | What is actually true about this one risk? | The risk |
Two rules that never bend
The field owns legality; the placement owns visibility. A layout can never widen or narrow which values are legal — that is enforced everywhere, including the API, CSV import and bulk edit. A layout only decides whether the question is asked and how it renders.
A layout rule can only take away. If your permissions do not let you open a record, no layout rule gives you a field. Layout rules filter on top of access; they are never a second way in.
Ownership versus exposure
Every object has exactly one home organisation unit. That is what an access grant reaches, and what makes roll-up arithmetic possible.
Anything else an object mentions — affected units, contributing teams, impacted countries — is exposure. Exposure moves numbers in reports. It never moves access.
Ownership decides who can open it. Exposure decides where it is counted. Collapsing the two into one field is the most common way a risk data model goes wrong.