# Phase 2 walkthrough

Use the existing Company Admin account and MFA. Platform Super Admin manages subscription/modules; employee data is accessed from the company account.

1. Open Employees to add a person or import a CSV. Employee IDs are company-unique. Import requires employee_number, first_name, last_name and joined_on; optional columns are email, phone and nationality. A failed row rolls back the entire import. Export uses the current directory filter and neutralizes spreadsheet formulas.
2. Open Employee 360 to edit details, link an existing company account, add dependants/contracts, and append an effective position assignment. Capacity checks include future assignments and position versions. Once an actual employee assignment exists for a position, actual assignment counts supersede Phase 1 planning occupancy. A position cannot be reduced below assigned capacity.
3. Open Document vault and create a record. Select a document type, matching owner category, and employee/company/branch owner. Document types define required records, expiry requirements and minimum retention; edit them in Document types.
4. Upload a PDF/JPEG/PNG. Files are validated by extension, MIME, signature, size, image dimensions and active-PDF-content checks, then encrypted in private quarantine and scanned. Scanner failures leave files unavailable. Retry after the real scanner is healthy. Earlier clean versions remain independently accessible to authorized users.
5. Once the latest file is ready, review it through an authenticated download/private preview and confirm its metadata. OCR can suggest extracted text when the isolated service is configured, but a person must still verify dates/reference. Uploading a replacement clears verification until the new version is reviewed.
6. Assign a renewal owner and due date from the document page. Upload new scanned evidence, submit it with costs/currency/notes, and verify the renewed dates. Old evidence cannot complete a new renewal; completion requires the latest clean version.
7. Use Compliance for expired/due documents, unverified records, missing required employee/company/branch records, and renewal status/ownership. Expiry dates use the company calendar day, including around UTC midnight.
8. Open Notifications to review delivery logs, update reminder days/roles/escalation/digest hour and plain-text templates, send a test to your own account, or retry a failed delivery. Run the queue/scheduler for automatic processing. Local email uses the log transport until SMTP is configured.
9. Place legal holds where required. Archive only when allowed; archived content cannot be downloaded. Operator purge respects retained-through dates and holds and removes file/OCR key metadata. Access logs record reads and failures without document content.

Employee, document and notification requests continue to enforce tenant membership and role permissions. A linked Employee role can read its own Employee 360/document records, while HR and PRO access comes from their explicit company permissions. A platform administrator does not implicitly enter company workspaces.

Recruitment, onboarding/career workflows and performance were subsequently delivered in Phase 3; see PHASE_3_WALKTHROUGH.md. Leave, attendance, payroll and asset/fleet integration remain later phases.