59 lines
2.6 KiB
Markdown
59 lines
2.6 KiB
Markdown
# Organization Model
|
|
|
|
The organization model answers where responsibility lives.
|
|
|
|
## Layers
|
|
|
|
- Tenant: the administrative space.
|
|
- Organization unit type: an abstract type such as faculty, institute,
|
|
committee, department, team, service desk, or legal entity.
|
|
- Organization structure: a named way to look at the institution. Several
|
|
structures may exist in parallel, for example employer hierarchy, academic
|
|
structure, committees, memberships, or classifications.
|
|
- Relation type: the permitted edge between units inside a structure.
|
|
- Organization unit: a concrete department, office, committee, service desk,
|
|
school, institute, or other unit.
|
|
- Function: a named responsibility in an organization unit, such as clerk,
|
|
reviewer, approver, committee secretary, intake desk, or resource manager.
|
|
- Function assignment: an identity holds a function in an organization unit,
|
|
optionally for that unit and all subunits. The assignment may be constrained
|
|
to a specific account, but the real-world responsibility belongs to the
|
|
identity.
|
|
|
|
## Boundary With Identity
|
|
|
|
Organization assignments refer to identity IDs and may optionally carry account
|
|
IDs for account-specific exercise of a function. This module does not own login
|
|
accounts, identity lifecycle, or account linking. `govoplan-identity` owns the
|
|
identity/account directory. The organization module records that an identity
|
|
currently holds an organizational function.
|
|
|
|
## Boundary With Access
|
|
|
|
A function assignment does not grant rights on its own. `govoplan-access`
|
|
maps organization facts to roles, rights, permission decisions, delegation
|
|
enforcement, and explain responses.
|
|
|
|
This separation keeps the institution model stable even when authorization
|
|
policy changes.
|
|
|
|
## UI Boundary
|
|
|
|
The organization workspace at `/organizations` is the primary module UI for
|
|
modelling the meta-model, concrete units, structures, functions, and
|
|
assignments. Admin-only organization controls are still owned by this module,
|
|
but are contributed to the platform admin shell through the `admin.sections`
|
|
WebUI capability.
|
|
|
|
The admin contribution must not duplicate the organization editor. It is for
|
|
governance and policy settings: whether tenant admins may customize the
|
|
meta-model, whether model changes require recorded change requests, and how
|
|
audit detail and retention behave for organization changes.
|
|
|
|
## Boundary With IDM
|
|
|
|
`govoplan-idm` may import organization units, functions, and assignments from
|
|
external directories. It should write through organization capabilities or APIs
|
|
after preview, approval, and rollback planning. IDM is a synchronization layer,
|
|
not the canonical owner of the organization model.
|