Use cases · Public sector
Public sectorGovernment, councils & shared services
One desk across several directorates, with an audit trail that answers a records request without anyone reconstructing a timeline by hand.
How IT usually works in this setting
Shared IT serves several directorates, agencies or business units that are funded separately but share infrastructure, and each one has to be able to report only on itself. Every access decision has to be explainable months later.
What it costs you today
- Access reviews are reconstructed from memory and spreadsheet exports.
- A directorate cannot prove its data was never visible to another directorate.
- External auditors ask who touched a record, and the answer takes days.
- Systems are split by cost centre rather than by who actually needs to see what.
What the desk does about it
- A wall, not a filter — Each directorate is a separate tenant on one platform. Separation is enforced server-side against your signed-in session, so it holds even if a URL is edited.
- Access you can explain later — Sessions, sign-ins and sensitive changes are recorded, and an administrator can review active sessions and end one immediately.
- Step-up for the sensitive actions — The actions that change money, exports or permissions can require a second check rather than trusting an open session.
- Reporting per directorate — Each unit gets its own dashboards and board pack from the same records, without a second system or a manual cut of the data.
“Who touched that record?”
An audit is coming and the team has been asked to prove isolation.
What we show you, in order
Shared services IT, three directorates, one platform
- Sign in as a service-desk analyst in Directorate A — the tenant switcher shows only A.
- Open a ticket, an asset and a person record. Everything resolves inside A.
- Paste the URL of a ticket that belongs to Directorate B into the address bar.
- The record does not open: the session is A, so the platform answers for A only.
- Review the session list, end an old session, and export the access record for the auditor.
Why it lands
The isolation conversation takes six minutes instead of an assurance project, and the evidence is a record rather than an explanation.
What we can stand behind
- Tenant separation is decided on the server against the signed-in session — never from a value the browser supplies.
- Administrators can see active sessions and revoke one without disturbing anyone else.
- Enquiry-to-tenant discovery uses a signed, short-lived handoff — no tenant identifier or secret is carried in a public URL.
- Full export of your records at any time, in an open format.
What we would need from you
- How the directorates, cost centres and reporting lines are structured today.
- Who must see what, in writing — the access matrix is the design.
- Your current ticketing export (CSV is fine) and your asset register.
- Two 60-minute sessions to agree the service catalogue and the categories.
What every one of these has in common.
The configuration changes by sector. The platform underneath it does not: one record per request, service levels per team, and tenancy enforced on the server.
One request, everything attached to it
The same data model behind all eight situations — which is why a sector change is a configuration change rather than a new product.