Enablement
Training and competency
A role-based curriculum built around one principle: competency includes knowing when the system is unavailable and when a decision has to be escalated. Passing the happy path is not the standard.
Shared orientation
What everybody learns first, regardless of role
Nine of these, and most of them are about the boundaries of the system rather than its features.
- Tenant context — what it is, and why a request that cannot resolve one fails rather than defaulting.
- Least privilege, and why an account is personal rather than shared.
- Multi-factor authentication, and the recovery route when it is unavailable.
- Safe note-writing: facts observed, not opinions held, and no unrelated third parties.
- Handling personal data — what may go in a ticket, a screenshot or an export, and what may not.
- Correlation identifiers, and using them instead of pasting a record into a message.
- Auditability: what is recorded about your actions, and who reviews it.
- Maker-checker, and why the second person cannot be you.
- The difference between an unavailable outcome and a clean one — the single most consequential distinction in the product.
- Incident reporting, and the difference between a proposal, an active version and immutable evidence.
Curriculum
Nine personas, and what each has to demonstrate
The right-hand column is the point. A module attended is not a competency; a task performed under observation is.
| Persona | Modules | Must be able to demonstrate |
|---|---|---|
| Front office | Customer and CDD capture, addresses, identifiers, ownership, documents, remediation. | Complete a valid application, and correct a rejected one, without leaking personal data. |
| AML analyst | Alert queue, transaction context, screening, cases, evidence and escalation. | Triage an alert, document the facts, adjudicate or route it, and open a subject-safe case. |
| MLRO | Risk approval, hit clearance, case closure, reporting, filing and retention. | Independently approve a decision, file with evidence, and handle an exception. |
| Compliance administrator | Forms, rules, watchlists, content packs, mappings and workflows. | Propose a change, simulate it, compare versions, obtain approval and activate it. |
| Auditor | Access review, the audit chain, retention, authority exports and evidence provenance. | Verify a chain, and produce a scoped evidence set for an examiner. |
| Executive | Dashboard, suppression, board artefacts, and interpreting risk and deadline signals. | Read aggregate metrics without requesting restricted records. |
| System administrator | Identity provider, roles, org units, service accounts, MFA and access review. | Onboard and deprovision a user, and prove negative access afterwards. |
| Platform operator | Deployment, secrets, database roles, storage, queue, backup, disaster recovery, incidents. | Deploy safely, restore in isolation, and lead a recovery smoke test. |
| Integration owner | Canonical transaction mapping, idempotency, quarantine, replay and reconciliation. | Replay a source batch and reconcile the accepted, duplicate and quarantined totals. |
Exercises
Everyone runs at least one failure path
Each learner completes a synthetic end-to-end journey and at least one of these. A team that has only ever seen the system work correctly cannot recognise the day it does not.
- A request made in the wrong tenant.
- A sign-in missing the required second factor.
- A duplicate source event arriving with the same external reference.
- A screening or identity provider that times out rather than answering.
- A transaction batch with mixed currencies.
- A metric that is unavailable rather than zero.
- An approval conflict, including an attempt to approve one's own request.
- A regulatory report rejected at validation.
Access and recertification
Training is an access control, not an onboarding formality
Which is why it sits next to the permission model rather than in an HR system.
Access is granted after a role-specific assessment and a manager or MLRO approval, not on the day someone joins. Users recertify annually, and again after a material change to a workflow, a policy or a regulation.
A user with repeated unsafe handling of personal data, unapproved exports, or attempts to bypass a control is suspended pending review. The audit trail is what makes that enforceable rather than anecdotal.
Training records, current standard operating procedures, permission reviews, acceptance sign-offs, incident exercises, backup and recovery drills and content-pack provenance are all retained as evidence. When an examiner asks how the institution knows its analysts are competent, that set is the answer.
Placeholder — no delivery format, schedule, duration, price, trainer or certification has been established for any of this curriculum. Replace with sourced, approved content before this page is made public.
Delivery — not yet defined
No course dates, durations, cohort sizes, delivery formats or prices have been set, and no certificate is issued by Baobyte. Nothing on this page should be read as an available or purchasable training programme.
If training is part of your implementation scope, raise it during the evaluation so it can be estimated properly rather than assumed.
Documentation
The controlled document set behind the curriculum, and who each document is for.
Open documentationImplementation
Where training sits in the path from discovery to go-live.
See the pathSupport
Tiers, severity and the audited support-access model.
Support modelRoles
What each persona is appraised on, and how the platform maps to it.
Analyst viewEnablement
Scope the training with the implementation
Competency is an access control here, so training sits on the critical path to go-live rather than after it. Tell us the personas and the headcount and it can be estimated properly.