Add organizations module surface

docs/ORGANIZATION_MODEL.md

@@ -5,19 +5,28 @@ The organization model answers where responsibility lives.
 ## Layers
 
 - Tenant: the administrative space.
-- Organization unit: a department, office, committee, service desk, school,
-  institute, or other structural unit.
+- Organization unit type: an abstract type such as faculty, institute,
+  committee, department, team, service desk, or legal entity.
+- Organization structure: a named way to look at the institution. Several
+  structures may exist in parallel, for example employer hierarchy, academic
+  structure, committees, memberships, or classifications.
+- Relation type: the permitted edge between units inside a structure.
+- Organization unit: a concrete department, office, committee, service desk,
+  school, institute, or other unit.
 - Function: a named responsibility in an organization unit, such as clerk,
   reviewer, approver, committee secretary, intake desk, or resource manager.
-- Function assignment: an account holds a function in an organization unit,
-  optionally for that unit and all subunits.
+- Function assignment: an identity holds a function in an organization unit,
+  optionally for that unit and all subunits. The assignment may be constrained
+  to a specific account, but the real-world responsibility belongs to the
+  identity.
 
 ## Boundary With Identity
 
-Organization assignments refer to account and identity IDs, but this module
-does not own login accounts or identity lifecycle. `govoplan-identity` owns the
-identity/account directory. The organization module only records that an
-account or identity currently holds an organizational function.
+Organization assignments refer to identity IDs and may optionally carry account
+IDs for account-specific exercise of a function. This module does not own login
+accounts, identity lifecycle, or account linking. `govoplan-identity` owns the
+identity/account directory. The organization module records that an identity
+currently holds an organizational function.
 
 ## Boundary With Access
 
@@ -28,6 +37,13 @@ enforcement, and explain responses.
 This separation keeps the institution model stable even when authorization
 policy changes.
 
+## UI Boundary
+
+The organization workspace at `/organizations` is the primary module UI for
+modelling concrete units, structures, functions, and assignments. Admin-only
+organization controls are still owned by this module, but are contributed to the
+platform admin shell through the `admin.sections` WebUI capability.
+
 ## Boundary With IDM
 
 `govoplan-idm` may import organization units, functions, and assignments from