[3m1n3nc3]

Summary

Business verification. Every organization is treated as a business that proves it may handle personal data before verifying identities in production. Development and staging stay open the whole time.

• Settings → Business verification takes legal and registration details, a data protection officer, a privacy policy URL and a certificate of incorporation (an optional data protection registration and certificate too).
• Platform admins review submissions in a new queue, approve or reject with a note, and can mark an organization verified directly. Managers are notified; a rejected organization corrects the prefilled form and resubmits.
• Unverified organizations can't create production projects (new ones default to development), and live sessions on production projects return 403 organization_unverified. Admins can switch the gate off under Admin → Settings → Compliance.

Delete projects and organizations. A danger zone on each settings page, confirmed by typing the exact name. Stored media is purged in bounded batches by a maintenance job, then the row delete cascades to everything in it. Organization deletions are kept in the platform audit log.

Sidebar counters. Reviews shows sessions awaiting review, the account sidebar shows pending invitations, Settings flags a business still to verify, and admins see pending extended access and verification counts.

Admin. The organization page shows verification, session outcomes, approval rate, reviews waiting, a 30-day trend, top open risk signals and usage. A new project page (/admin/organizations/:id/projects/:pid) shows configuration, effective thresholds, extended access, outcomes and recent sessions.

Smaller changes.

• New projects start with Arkyc's primary color instead of white.
• A Documentation link in every sidebar opens the website's /docs (VITE_WEBSITE_URL, set by the Cloudflare deploy).
• Extended access greys out capabilities already granted or awaiting review, and hides the request form when nothing is left to request.
• The workflow auto-verify hint shows the accepted range and the project default.
• CLAUDE.md links to AGENTS.md, which now asks for a branch with one commit per feature and no credits in commits, PRs or release notes.
• The API lint config requires blank lines between statements.

Before deploying

The verification gate is on by default. On an instance with production projects, verify those organizations (or mark them verified from their admin page) right after deploying, or switch the gate off first, otherwise their live sessions are refused. Two migrations add the verification columns and table.

Tests

• Business verification: production refused before verification, live sessions refused on an existing production project, validation, submit, double submit, admin count and document, reject without a note, approve, then production allowed; admin-only access.
• Deletion: wrong name refused, then the project and its sessions are gone; organization deletion removes its projects.
• Admin views: organization detail stats and trend, the project page.
• API: 272 passed. Packages and dashboard: all passed.