Organization Model

The organization model answers where responsibility lives.

Layers

Tenant: the administrative space.
Organization unit type: an abstract type such as faculty, institute, committee, department, team, service desk, or legal entity.
Organization structure: a named way to look at the institution. Several structures may exist in parallel, for example employer hierarchy, academic structure, committees, memberships, or classifications.
Relation type: the permitted edge between units inside a structure.
Organization unit: a concrete department, office, committee, service desk, school, institute, or other unit.
Function: a named responsibility in an organization unit, such as clerk, reviewer, approver, committee secretary, intake desk, or resource manager.
Function assignment: an identity holds a function in an organization unit, optionally for that unit and all subunits. The assignment may be constrained to a specific account, but the real-world responsibility belongs to the identity.

Boundary With Identity

Organization assignments refer to identity IDs and may optionally carry account IDs for account-specific exercise of a function. This module does not own login accounts, identity lifecycle, or account linking. govoplan-identity owns the identity/account directory. The organization module records that an identity currently holds an organizational function.

Boundary With Access

A function assignment does not grant rights on its own. govoplan-access maps organization facts to roles, rights, permission decisions, delegation enforcement, and explain responses.

This separation keeps the institution model stable even when authorization policy changes.

UI Boundary

The organization workspace at /organizations is the primary module UI for modelling concrete units, structures, functions, and assignments. Admin-only organization controls are still owned by this module, but are contributed to the platform admin shell through the admin.sections WebUI capability.

Boundary With IDM

govoplan-idm may import organization units, functions, and assignments from external directories. It should write through organization capabilities or APIs after preview, approval, and rollback planning. IDM is a synchronization layer, not the canonical owner of the organization model.

2.3 KiB Raw Blame History