Company Policies

Flowtly Editorial Team3 min

Company policies are the internal rules an organization writes down and keeps current — time-off handling, benefit entitlements, expense limits, equipment use. Every employee can read them. Only an administrator can write them.

Each policy is a page with a permanent identifier, and its wording is kept as a series of versions. A version carries the date it came into force, so the page can answer the question that matters when a rule has changed: what applied on 15 March? Earlier wording is never overwritten and never deleted — it stays readable at its own date, which is what makes a policy usable as evidence months later.

Reading a policy

The policy list shows every policy in the organization. Opening one shows the version in force today, with its start date beside the title.

The version history alongside the page lists every version and labels each one:

  • In force — the wording that applies today. There is exactly one.
  • Archived — wording that applied earlier and has since been superseded. Still readable.
  • Scheduled — wording that has been written but whose start date has not arrived. It does not apply yet.

Selecting an archived version opens it, with a notice saying plainly that it is not today's rule. Setting the As of date to a day in the past shows what applied on that day.

Policies link to one another. A link inside a policy always resolves to whichever version of the target is in force when you follow it, never to the wording that was current when the link was written.

Writing a policy

These actions appear only for administrators. Everyone else sees the same pages without them.

New policy creates the page. It asks for a title and an identifier. The identifier is what other policies use to link here, and it cannot be changed afterwards — nothing records which policies link to a given page, so renaming it would break those links silently.

Rename changes the title only, for the same reason.

Publish version adds a new version. It asks for the wording and the date it comes into force:

  • Today — it becomes the version in force immediately, and the previous one becomes archived.
  • A future date — it is stored as scheduled. Employees continue to see the current wording until that date arrives, and the editor says so when a future date is chosen. This is how a rule change announced in advance is prepared without taking effect early.

Publishing always adds. There is no way to edit or delete a published version, and that is deliberate: a version that could be changed after the fact could no longer answer what applied in March, and one that could be deleted would answer it wrongly. A correction is published as a new version, exactly as an amendment works on paper.

Example use cases

  • Publish the time-off policy so every employee can read the current rules without asking.
  • Answer an accountant's question about which benefit rule applied on the date a payment was made.
  • Prepare next quarter's expense limits in advance and let them take effect automatically on the first of the month.
  • Correct a mistake in the current wording by publishing a corrected version, leaving the record of what was previously in force intact.
  • Link the equipment policy from the onboarding policy so a new employee follows one page to the next.

Connection map

Refers toPart ofFulfils
Documented hereDocumented elsewhere
audit-log records person. setting defines attribute. org-document access governed by setting. subscription gates setting. setting requires second-factor. second-factor held by person. recovery-code stands in for second-factor. trusted-device waives second-factor.recordsdefinesaccess governed bygatesrequiresheld bystands in forwaivesAAudit trail — The record of who did what and when. It is how a user action is investigated after the fact, and what compliance is demonstrated from.Audit trailPPerson — An employee. The central record the rest of the workforce data hangs off — profile, documents, leave, benefits, rates.PersonSSetting — Platform-wide configuration — behaviours, permissions, security.SettingAAttribute — A custom data field defined once and collected across the platform, so an organisation can record what Flowtly does not ship a field for.AttributeDDocument — An organisational file, stored with control over who can reach it.DocumentSSubscription — The plan the organisation is on, and what it is billed for.SubscriptionSSecond factor — The extra proof of identity asked for at sign-in on top of the password — a six-digit code from an authenticator app, changing every 30 seconds.Second factorRRecovery code — One of ten single-use codes issued when an authenticator is confirmed. Each stands in for a code from the app once, for the day the phone is gone.Recovery codeTTrusted device — A browser a person has chosen to trust, which is not asked for a second factor again for 30 days. Per browser, not per person.Trusted device