1.4 KiB
Organization Model
The organization model answers where responsibility lives.
Layers
- Tenant: the administrative space.
- Organization unit: a department, office, committee, service desk, school, institute, or other structural unit.
- Function: a named responsibility in an organization unit, such as clerk, reviewer, approver, committee secretary, intake desk, or resource manager.
- Function assignment: an account holds a function in an organization unit, optionally for that unit and all subunits.
Boundary With Identity
Organization assignments refer to account and identity IDs, but this module
does not own login accounts or identity lifecycle. govoplan-identity owns the
identity/account directory. The organization module only records that an
account or identity currently holds an organizational function.
Boundary With Access
A function assignment does not grant rights on its own. govoplan-access
maps organization facts to roles, rights, permission decisions, delegation
enforcement, and explain responses.
This separation keeps the institution model stable even when authorization policy changes.
Boundary With IDM
govoplan-idm may import organization units, functions, and assignments from
external directories. It should write through organization capabilities or APIs
after preview, approval, and rollback planning. IDM is a synchronization layer,
not the canonical owner of the organization model.