One-install Deel front door over 9 separately bounded official API domains: organization and compliance, contractors, Global Payroll, HRIS, EOR, ATS, IT, accounting, and SCIM. It bundles read-only operating views plus narrow approval-gated task, timesheet, and time-off intakes. Reads are installed on; dependency write/admin/destructive groups remain off until explicitly granted and still ask or always require approval. Worker-token self-service is intentionally a separate deel-worker pack. Credential and login-link issuance, webhook signing-key responses, password changes, multipart uploads, and presigned upload initiation are excluded.