Initialize organizations module

docs/ORGANIZATION_MODEL.md

@@ -0,0 +1,36 @@
+# Organization Model
+
+The organization model answers where responsibility lives.
+
+## Layers
+
+- Tenant: the administrative space.
+- Organization unit: a department, office, committee, service desk, school,
+  institute, or other structural unit.
+- Function: a named responsibility in an organization unit, such as clerk,
+  reviewer, approver, committee secretary, intake desk, or resource manager.
+- Function assignment: an account holds a function in an organization unit,
+  optionally for that unit and all subunits.
+
+## Boundary With Identity
+
+Organization assignments refer to account and identity IDs, but this module
+does not own login accounts or identity lifecycle. `govoplan-identity` owns the
+identity/account directory. The organization module only records that an
+account or identity currently holds an organizational function.
+
+## Boundary With Access
+
+A function assignment does not grant rights on its own. `govoplan-access`
+maps organization facts to roles, rights, permission decisions, delegation
+enforcement, and explain responses.
+
+This separation keeps the institution model stable even when authorization
+policy changes.
+
+## Boundary With IDM
+
+`govoplan-idm` may import organization units, functions, and assignments from
+external directories. It should write through organization capabilities or APIs
+after preview, approval, and rollback planning. IDM is a synchronization layer,
+not the canonical owner of the organization model.