37 lines
1.4 KiB
Markdown
37 lines
1.4 KiB
Markdown
# Organization Model
|
|
|
|
The organization model answers where responsibility lives.
|
|
|
|
## Layers
|
|
|
|
- Tenant: the administrative space.
|
|
- Organization unit: a department, office, committee, service desk, school,
|
|
institute, or other structural unit.
|
|
- Function: a named responsibility in an organization unit, such as clerk,
|
|
reviewer, approver, committee secretary, intake desk, or resource manager.
|
|
- Function assignment: an account holds a function in an organization unit,
|
|
optionally for that unit and all subunits.
|
|
|
|
## Boundary With Identity
|
|
|
|
Organization assignments refer to account and identity IDs, but this module
|
|
does not own login accounts or identity lifecycle. `govoplan-identity` owns the
|
|
identity/account directory. The organization module only records that an
|
|
account or identity currently holds an organizational function.
|
|
|
|
## Boundary With Access
|
|
|
|
A function assignment does not grant rights on its own. `govoplan-access`
|
|
maps organization facts to roles, rights, permission decisions, delegation
|
|
enforcement, and explain responses.
|
|
|
|
This separation keeps the institution model stable even when authorization
|
|
policy changes.
|
|
|
|
## Boundary With IDM
|
|
|
|
`govoplan-idm` may import organization units, functions, and assignments from
|
|
external directories. It should write through organization capabilities or APIs
|
|
after preview, approval, and rollback planning. IDM is a synchronization layer,
|
|
not the canonical owner of the organization model.
|