60 lines
2.6 KiB
Markdown
60 lines
2.6 KiB
Markdown
# Organization Model
|
|
|
|
The organization model answers where responsibility lives.
|
|
|
|
## Layers
|
|
|
|
- Tenant: the administrative space.
|
|
- Organization unit type: an abstract type such as faculty, institute,
|
|
committee, department, team, service desk, or legal entity.
|
|
- Organization structure: a named way to look at the institution. Several
|
|
structures may exist in parallel, for example employer hierarchy, academic
|
|
structure, committees, memberships, or classifications.
|
|
- Relation type: the permitted edge between units inside a structure.
|
|
- Organization unit: a concrete department, office, committee, service desk,
|
|
school, institute, or other unit.
|
|
- Function: a named responsibility in an organization unit, such as clerk,
|
|
reviewer, approver, committee secretary, intake desk, or resource manager.
|
|
|
|
## Boundary With Identity And IDM
|
|
|
|
This module does not own login accounts, identity lifecycle, account linking,
|
|
or identity-to-function assignments. `govoplan-identity` owns the
|
|
identity/account directory. `govoplan-idm` records that an identity currently
|
|
holds an organizational function and may constrain that link to one account.
|
|
|
|
Resolving accounts to identities, choosing candidate identities for an
|
|
organization assignment, and importing those mappings from external directories
|
|
belongs to `govoplan-idm`, not to organizations.
|
|
|
|
## Boundary With Access
|
|
|
|
An IDM function assignment does not grant rights on its own. `govoplan-access`
|
|
maps organization and IDM facts to roles, rights, permission decisions,
|
|
delegation enforcement, and explain responses.
|
|
|
|
This separation keeps the institution model stable even when authorization
|
|
policy changes.
|
|
|
|
## UI Boundary
|
|
|
|
The organization workspace at `/organizations` is the primary module UI for
|
|
modelling the meta-model, concrete units, structures, and function definitions.
|
|
Admin-only organization controls are still owned by this
|
|
module, but are contributed to the platform admin shell through the
|
|
`admin.sections` WebUI capability.
|
|
|
|
The admin contribution must not duplicate the organization editor. It is for
|
|
governance and policy settings: whether tenant admins may customize the
|
|
meta-model, whether model changes require recorded change requests, and how
|
|
audit detail and retention behave for organization changes.
|
|
|
|
## Boundary With IDM
|
|
|
|
`govoplan-idm` may import organization-unit and organization-function
|
|
definitions from external directories. It should write those definitions
|
|
through organization capabilities or APIs after preview, approval, and rollback
|
|
planning. IDM owns identity-to-function assignments and bridge views that
|
|
combine identity and organization facts, such as identity candidates for
|
|
function assignments.
|