backend module manifest postbox
postbox permissions and policy checks
postbox, binding, message, participant, attachment-reference, and audit-facing data models
role-organization-bound access resolution for postboxes
API routes for postbox directory, messages, access checks, and administration
optional integration capabilities for campaign, files, portal, notification, and mail-facing workflows
future WebUI package @govoplan/postbox-webui

Core owns auth, tenants, RBAC evaluation, database/session primitives, module discovery, migrations, CSRF/API helpers, and shell layout. Access owns identities, users, groups, roles, memberships, and administrative RBAC surfaces.

Role-bound postboxes

A function-bound postbox is linked to an organizational unit and one or more institutional functions. It can exist with zero, one, or several current incumbents. A person can access it only while their identity has an effective assignment or time-bounded delegation in that organizational context. Access is not tied to a login mailbox, personal email address, or static user assignment.

When the assignment changes, postbox access and encrypted key grants change with it. The postbox keeps durable content and evidence history through vacancy, hand-over, and delegation; multiple incumbents receive independently auditable access. Revocation prevents future platform key access but cannot erase plaintext already fetched or exported.

Module integration

Backend entry point:

[project.entry-points."govoplan.modules"]
postbox = "govoplan_postbox.backend.manifest:get_manifest"

Frontend package:

@govoplan/postbox-webui

Platform RBAC, module capability contracts, and governance rules are documented in govoplan-core/docs/.