Platform Administration - Multi-Entity Management is where ERP discipline either begins or breaks.
Multi-Entity / Multi-Tenant Hierarchy Administration looks operational from far away. In a real finance team, it is a chain of assertions: the right actor started the work, the required records existed, the control policy was applied, the state change was preserved, and the outcome can be explained later without rebuilding the transaction from emails and spreadsheets.
The expected business outcome is specific: Finance team manages 20+ legal entities from a single login with zero cross-entity data leakage; consolidation that previously took 3 days runs in minutes.
The control flow a finance team actually needs.
Step 1
Entity Tree ≥5 Levels Of Hierarchy
Step 2
Org Id And Entity Id Are Always Sourced...
Step 3
Creating An Entity Provisions Default...
Step 4
Cross-Entity Data Access Requires...
Step 5
Consolidated Reports Run In ≤10 S For...
The ERP surface involved.
Module
Platform Administration - Multi-Entity Management
Actors
Org Administrator, Entity Administrator, Finance Controller
Tier
Tier 2
Finance area
Platform, Integration, Security, Administration & Analytics
Region lens
US and UK finance teams
Publication date
June 18, 2026
Entity tree supports ≥5 levels of hierarchy; org_id and entity_id are always sourced from JWT claims, never from request body (ADR-002); creating an entity provisions default CoA, SoD roles, and FGA tuples atomically in a single transaction; cross-entity data access requires explicit intercompany permission grant; consolidated reports run in ≤10 s for up to 50 entities; entity deletion is soft-archive only (State-B backward-compat rule); each entity carries its own functional currency and fiscal calendar.
US and UK teams have different compliance hooks, but the same control problem.
US teams usually care about clean evidence for audit support, vendor records, payment controls, tax reporting, and management review. UK teams usually care about VAT-ready records, approval evidence, digital-record discipline, and traceable postings. The country-specific details differ, but the operating pattern is the same: the ERP needs controlled records, explicit ownership, defensible state changes, and evidence that survives beyond the person who completed the task.
The control matrix.
| Control area | Requirement | Acceptance proof |
|---|---|---|
| Control 1 | Entity tree supports ≥5 levels of hierarchy | Given an org with existing entities |
| Control 2 | org_id and entity_id are always sourced from JWT claims, never from request body (ADR-002 | when org admin creates a new entity with functional currency, fiscal year, and CoA template, then a default CoA, SoD roles, and FGA tuples are created atomically in a single transaction and the entity is immediately accessible via its entity_id JWT claim |
| Control 3 | creating an entity provisions default CoA, SoD roles, and FGA tuples atomically in a single transaction | when a user from entity A attempts to access entity B data without explicit intercompany permission, then the request is rejected with 403 |
| Control 4 | cross-entity data access requires explicit intercompany permission grant | negative) when entity creation payload includes org_id in request body instead of JWT claim, then the server ignores the body value and uses only the JWT-sourced org_id. |
| Control 5 | consolidated reports run in ≤10 s for up to 50 entities | Finance team manages 20+ legal entities from a single login with zero cross-entity data leakage; consolidation that previously took 3 days runs in minutes. |
| Control 6 | entity deletion is soft-archive only (State-B backward-compat rule | Finance team manages 20+ legal entities from a single login with zero cross-entity data leakage; consolidation that previously took 3 days runs in minutes. |
Audit evidence is a chain, not a folder.
| Evidence layer | What should be preserved |
|---|---|
| Business event | Org Administrator creates a new legal entity under the parent organization, assigns functional currency, fiscal year, chart-of-accounts template, and jurisdiction. Every subsequent API call from entity users is JWT-scoped to both org_id and entity_id so data never leaks across entities. Intercompany eliminations are configured as auto-posting rules. Consolidated financial reports aggregate across selected entities with currency translation applied. Entity onboarding completes with a checklist verifying CoA, bank accounts, and opening balances. |
| Control rules | Entity tree supports ≥5 levels of hierarchy; org_id and entity_id are always sourced from JWT claims, never from request body (ADR-002); creating an entity provisions default CoA, SoD roles, and FGA tuples atomically in a single transaction; cross-entity data access requires explicit intercompany permission grant; consolidated reports run in ≤10 s for up to 50 entities; entity deletion is soft-archive only (State-B backward-compat rule); each entity carries its own functional currency and fiscal calendar. |
| Acceptance proof | Given an org with existing entities; when org admin creates a new entity with functional currency, fiscal year, and CoA template, then a default CoA, SoD roles, and FGA tuples are created atomically in a single transaction and the entity is immediately accessible via its entity_id JWT claim; when a user from entity A attempts to access entity B data without explicit intercompany permission, then the request is rejected with 403; (negative) when entity creation payload includes org_id in request body instead of JWT claim, then the server ignores the body value and uses only the JWT-sourced org_id. |
| Data record | |
| System event | |
| Lifecycle state | |
The useful version of this workflow is not only fast. It is inspectable. A controller, auditor, or operator should be able to move from source event to system record to state transition to final business outcome without guessing.
Implementation contracts.
Reference data model
`entity` { entity_id: string, org_id: string, name: string, functional_currency: char(3), fiscal_year_end: date, status: enum(ACTIVE,ARCHIVED), external_id: string }; `entity_hierarchy` { parent_entity_id: string, child_entity_id: string, depth: int }; `entity_config` { entity_id: string, coa_template_id: string, locale: string }; (reference, product may differ).API and events
`POST /v1/entities` { name, functional_currency, fiscal_year_end, coa_template_id } -> 201 { entity_id, name, status }; `GET /v1/entities/{entity_id}`; `GET /v1/entities?parent_id=`; `POST /v1/consolidated-reports` { entity_ids[], period } -> 202 { report_id }; emits `entity.created` and `entity.archived` events; idempotent via `external_id`.State transitions
`PROVISIONING -> ACTIVE`; terminal `ARCHIVED`; guard: soft-archive only (no hard delete); cross-entity data access requires explicit intercompany permission grant; atomic provisioning - partial failure rolls back CoA/roles/FGA entirely.Common implementation traps.
Treating the workflow as data entry
If the ERP only stores the final record, the team loses the decision trail that explains how the record became valid.
Hiding exception logic
Exceptions need owners, reason codes, and time stamps. A vague pending state is not a control.
Posting without recovery design
Retries, duplicate submissions, and partial failures must be explicit so the system does not create inconsistent records.
Skipping evidence design
A workflow that cannot produce evidence on demand will eventually push finance teams back into manual screenshots and spreadsheets.
Where Rivane fits.
Rivane is built for finance workflows where automation must stay tied to source documents, approvals, state transitions, ledger impact, reporting, and audit evidence. Use this guide as a checklist for evaluating whether an ERP workflow is merely digitized or actually controlled.
References and source basis.
These sources provide the standards, regulatory, or government context around the flow. They are included so the guide is useful to finance operators, auditors, and implementation teams, not only buyers reading software copy.