# Organization Model

The organization model answers where responsibility lives.

## Layers

- Tenant: the administrative space.
- Organization unit: a department, office, committee, service desk, school,
  institute, or other structural unit.
- Function: a named responsibility in an organization unit, such as clerk,
  reviewer, approver, committee secretary, intake desk, or resource manager.
- Function assignment: an account holds a function in an organization unit,
  optionally for that unit and all subunits.

## Boundary With Identity

Organization assignments refer to account and identity IDs, but this module
does not own login accounts or identity lifecycle. `govoplan-identity` owns the
identity/account directory. The organization module only records that an
account or identity currently holds an organizational function.

## Boundary With Access

A function assignment does not grant rights on its own. `govoplan-access`
maps organization facts to roles, rights, permission decisions, delegation
enforcement, and explain responses.

This separation keeps the institution model stable even when authorization
policy changes.

## Boundary With IDM

`govoplan-idm` may import organization units, functions, and assignments from
external directories. It should write through organization capabilities or APIs
after preview, approval, and rollback planning. IDM is a synchronization layer,
not the canonical owner of the organization model.