feat: add versioned organization model templates

docs/ORGANIZATION_MODEL.md

@@ -16,6 +16,31 @@ The organization model answers where responsibility lives.
 - Function: a named responsibility in an organization unit, such as clerk,
   reviewer, approver, committee secretary, intake desk, or resource manager.
 
+## Governance And Templates
+
+Concrete organization models are tenant-owned. Units, structures, relation
+types, relations, function types, and functions are never shared as one live
+global hierarchy across tenants.
+
+The system may provide versioned organization-model templates. A tenant
+explicitly instantiates one template version and receives tenant-owned concrete
+records. The template reference and version are provenance, not a live parent
+model:
+
+- tenants may run different template versions;
+- a template update never silently mutates a tenant hierarchy;
+- upgrading is an explicit diff and migration with preview, conflict
+  reporting, and recorded provenance;
+- system policy may constrain permitted unit, relation, structure, and
+  function types;
+- tenant administrators customize concrete records only within the effective
+  policy.
+
+This avoids ambiguous inheritance when institutions model responsibility
+differently. Template catalogue, instantiation, and upgrade orchestration are a
+separate implementation slice; the existing organization tables remain the
+canonical tenant-local state.
+
 ## Boundary With Identity And IDM
 
 This module does not own login accounts, identity lifecycle, account linking,