Organization Configuration¶
Overview¶
This user story covers the configuration of organization settings on the REC Verifiable Credentialing Platform. After an organization has been registered and verified, administrators need to configure various settings to customize the platform for their organization's needs.
User Stories¶
Basic Organization Settings¶
As an organization administrator,
I want to configure basic organization settings,
So that the platform reflects our organization's information and preferences.
Acceptance Criteria: - The system provides a settings page for organization administrators - The system allows updating the following organization information: - Organization name - Organization contact details - Organization address - Organization website - The system validates all inputs before saving - The system maintains a history of changes to organization settings - The system notifies relevant users of significant changes to organization settings - The system applies changes immediately after saving
Terms and Conditions Configuration¶
As an organization administrator,
I want to configure organization-specific terms and conditions,
So that our legal requirements are met when issuing or verifying credentials.
Acceptance Criteria: - The system allows uploading and editing organization-specific terms and conditions - The system supports rich text formatting for terms and conditions - The system maintains version history of terms and conditions - The system allows setting an effective date for terms and conditions - The system displays the organization's terms and conditions to candidates during credential issuance - The system requires candidates to accept terms and conditions before receiving credentials - The system logs acceptance of terms and conditions for audit purposes
Privacy Policy Configuration¶
As an organization administrator,
I want to configure organization-specific privacy policies,
So that we comply with data protection regulations when handling candidate data.
Acceptance Criteria: - The system allows uploading and editing organization-specific privacy policies - The system supports rich text formatting for privacy policies - The system maintains version history of privacy policies - The system allows setting an effective date for privacy policies - The system displays the organization's privacy policy to candidates during credential issuance - The system requires candidates to accept the privacy policy before receiving credentials - The system logs acceptance of privacy policies for audit purposes
System Notification Settings¶
As an organization administrator,
I want to configure system notification settings,
So that our team receives appropriate notifications about platform activities.
Acceptance Criteria: - The system allows configuring email notifications for different event types: - New credential requests - Credential issuance status changes - Verification requests - Verification status changes - User account changes - The system allows setting notification recipients by role or individual user - The system supports customizing notification frequency (immediate, daily digest, weekly digest) - The system allows enabling/disabling specific notification types - The system provides a preview of notification templates - The system tests notification delivery to ensure emails are received
Technical Details¶
Organization Settings Schema¶
The organization settings entity will include: - organization_id (UUID, foreign key to organizations) - settings_type (enum: GENERAL, TERMS, PRIVACY, NOTIFICATIONS) - settings_data (JSON object containing the settings) - version (integer) - effective_from (timestamp) - created_by (UUID, foreign key to users) - created_at (timestamp) - updated_at (timestamp)
Configuration Storage¶
- Terms and conditions and privacy policies will be stored as HTML content
- Version history will be maintained for all configuration changes
- Configuration changes will be logged for audit purposes
- Configuration data will be cached for performance
Security Considerations¶
- Access to organization configuration must be restricted to organization administrators
- All configuration changes must be logged for audit purposes
- Sensitive configuration data must be encrypted at rest
- Configuration API endpoints must be protected against CSRF attacks