# GovOPlaN Organizations

<!-- govoplan-repository-type:start -->
**Repository type:** module (platform).
<!-- govoplan-repository-type:end -->

`govoplan-organizations` is the canonical organizational model module for
GovOPlaN.

It owns organization unit types, organization structures, concrete units, and
functions. These facts exist independently of authentication and authorization.
Identity links people to accounts, IDM links identities to organization
functions, and Access projects accepted facts into roles and rights.

## Boundary

Organizations owns:

- tenant-local organization unit types
- tenant-local concrete organization units
- parallel organization structures and relation types
- functions in organization units
- whether a function may be delegated or used for acting in place

Organizations does not own:

- login accounts, identity lifecycle, or account linking
- identity-to-function assignments or candidate search; those bridges are owned by `govoplan-idm`
- role and permission evaluation
- postboxes, workflows, portals, files, or cases
- external IDM connector internals

The WebUI exposed by this repository is a normal module UI at
`/organizations`. It is the editing surface for the meta-model, concrete
organization tree, structures, and functions.

Admin-only controls are contributed by this module through the platform
`admin.sections` WebUI capability, so the admin shell can show them when the
organizations module is active. Those controls are limited to governance and
policy settings such as tenant model customization, change-request
requirements, audit detail, and retention behavior.

The reviewed surface inventory, consequence classes, availability rules, and
accessibility evidence are recorded in
[`docs/INTERFACE_PATTERN_MIGRATION.md`](docs/INTERFACE_PATTERN_MIGRATION.md).

## Module Contract

The module registers organization-directory capabilities from
`govoplan_core.core.organizations` and a privacy capability:

- `organizations.directory` for backward-compatible direct unit/function
  lookup;
- `organizations.hierarchyDirectory` for typed, tenant-safe, explicitly
  structure-scoped hierarchy and path resolution.
- `privacy.dsar.organizations` for tenant-scoped account attribution on model
  instantiations and upgrades.

The DSAR provider does not treat institutional units or functions as personal
records. It retains model-change attribution as governance evidence and excludes
global templates, opaque definitions, previews, decisions, provenance,
idempotency material, and other tenants. Identity-to-function assignments are
covered by IDM, which owns that relationship.

Feature modules should consume the capability instead of importing
organization ORM models.

## Development Install

From the core checkout:

```bash
cd /mnt/DATA/git/govoplan-core
./.venv/bin/python -m pip install -e ../govoplan-organizations
```