Document organization projection migration

docs/ORGANIZATION_MODEL.md

@@ -36,6 +36,36 @@ delegation enforcement, and explain responses.
 This separation keeps the institution model stable even when authorization
 policy changes.
 
+## Access Projection Migration
+
+`govoplan-access` now prefers `organizations.directory` for organization units
+and function definitions when the Organizations module is installed. It uses
+`govoplan-idm` for identity-to-function assignment facts and Access-owned
+external function-role mappings to turn accepted function facts into rights.
+
+The legacy Access tables `access_organization_units`, `access_functions`, and
+`access_function_assignments` remain readable as compatibility/projection
+tables during rollout. They are no longer the target model for new module
+integrations.
+
+Rollout plan:
+
+- keep direct Access function/organization reads as a fallback when
+  Organizations or IDM are not installed;
+- backfill Organizations units/functions from the Access projection for
+  existing installations that enable the Organizations module later;
+- move new identity-to-function assignment workflows to IDM rather than adding
+  assignment ownership to Organizations;
+- use Access external function-role mappings for authorization and check that
+  the referenced Organizations function is still active before granting
+  derived permissions;
+- retire Access-owned organization/function tables only after a release-level
+  migration/backfill and rollback plan exists.
+
+The close-out condition is that Access role resolution works with canonical
+Organizations plus IDM installed and still works through projection fallback
+for transition deployments.
+
 ## UI Boundary
 
 The organization workspace at `/organizations` is the primary module UI for