add-ideas/govoplan-organizations
1
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

Sync GovOPlaN module state

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-10 21:57:27 +02:00
parent 669647a986
commit 1f69e6b5a7
15 changed files with 485 additions and 722 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
docs/ORGANIZATION_MODEL.md
View File

@@ -15,24 +15,23 @@ The organization model answers where responsibility lives.
school, institute, or other unit.
- Function: a named responsibility in an organization unit, such as clerk,
reviewer, approver, committee secretary, intake desk, or resource manager.
- Function assignment: an identity holds a function in an organization unit,
optionally for that unit and all subunits. The assignment may be constrained
to a specific account, but the real-world responsibility belongs to the
identity.
## Boundary With Identity
## Boundary With Identity And IDM
Organization assignments refer to identity IDs and may optionally carry account
IDs for account-specific exercise of a function. This module does not own login
accounts, identity lifecycle, or account linking. `govoplan-identity` owns the
identity/account directory. The organization module records that an identity
currently holds an organizational function.
This module does not own login accounts, identity lifecycle, account linking,
or identity-to-function assignments. `govoplan-identity` owns the
identity/account directory. `govoplan-idm` records that an identity currently
holds an organizational function and may constrain that link to one account.
Resolving accounts to identities, choosing candidate identities for an
organization assignment, and importing those mappings from external directories
belongs to `govoplan-idm`, not to organizations.
## Boundary With Access
A function assignment does not grant rights on its own. `govoplan-access`
maps organization facts to roles, rights, permission decisions, delegation
enforcement, and explain responses.
An IDM function assignment does not grant rights on its own. `govoplan-access`
maps organization and IDM facts to roles, rights, permission decisions,
delegation enforcement, and explain responses.
This separation keeps the institution model stable even when authorization
policy changes.
@@ -40,10 +39,10 @@ policy changes.
## UI Boundary
The organization workspace at `/organizations` is the primary module UI for
modelling the meta-model, concrete units, structures, functions, and
assignments. Admin-only organization controls are still owned by this module,
but are contributed to the platform admin shell through the `admin.sections`
WebUI capability.
modelling the meta-model, concrete units, structures, and function definitions.
Admin-only organization controls are still owned by this
module, but are contributed to the platform admin shell through the
`admin.sections` WebUI capability.
The admin contribution must not duplicate the organization editor. It is for
governance and policy settings: whether tenant admins may customize the
@@ -52,7 +51,9 @@ audit detail and retention behave for organization changes.
## Boundary With IDM
`govoplan-idm` may import organization units, functions, and assignments from
external directories. It should write through organization capabilities or APIs
after preview, approval, and rollback planning. IDM is a synchronization layer,
not the canonical owner of the organization model.
`govoplan-idm` may import organization-unit and organization-function
definitions from external directories. It should write those definitions
through organization capabilities or APIs after preview, approval, and rollback
planning. IDM owns identity-to-function assignments and bridge views that
combine identity and organization facts, such as identity candidates for
function assignments.