# Organization Model

The organization model answers where responsibility lives.

## Layers

- Tenant: the administrative space.
- Organization unit type: an abstract type such as faculty, institute,
  committee, department, team, service desk, or legal entity.
- Organization structure: a named way to look at the institution. Several
  structures may exist in parallel, for example employer hierarchy, academic
  structure, committees, memberships, or classifications.
- Relation type: the permitted edge between units inside a structure.
- Organization unit: a concrete department, office, committee, service desk,
  school, institute, or other unit.
- Function: a named responsibility in an organization unit, such as clerk,
  reviewer, approver, committee secretary, intake desk, or resource manager.
- Function assignment: an identity holds a function in an organization unit,
  optionally for that unit and all subunits. The assignment may be constrained
  to a specific account, but the real-world responsibility belongs to the
  identity.

## Boundary With Identity

Organization assignments refer to identity IDs and may optionally carry account
IDs for account-specific exercise of a function. This module does not own login
accounts, identity lifecycle, or account linking. `govoplan-identity` owns the
identity/account directory. The organization module records that an identity
currently holds an organizational function.

## Boundary With Access

A function assignment does not grant rights on its own. `govoplan-access`
maps organization facts to roles, rights, permission decisions, delegation
enforcement, and explain responses.

This separation keeps the institution model stable even when authorization
policy changes.

## UI Boundary

The organization workspace at `/organizations` is the primary module UI for
modelling concrete units, structures, functions, and assignments. Admin-only
organization controls are still owned by this module, but are contributed to the
platform admin shell through the `admin.sections` WebUI capability.

## Boundary With IDM

`govoplan-idm` may import organization units, functions, and assignments from
external directories. It should write through organization capabilities or APIs
after preview, approval, and rollback planning. IDM is a synchronization layer,
not the canonical owner of the organization model.